Bug 740958 - crash in nsAccessible::GetBounds, r=tbsaunde
authorAlexander Surkov <surkov.alexander@gmail.com>
Mon, 02 Apr 2012 17:28:02 +0900
changeset 94118 93251eb39b6e83d366935dd769091e9cc9708525
parent 94117 3e46009daea3ca4538a1fe4cd49c4ce3ed3546e6
child 94119 85a31c1e4963f5627a76ae92241eb388da40d00c
push id886
push userlsblakk@mozilla.com
push dateMon, 04 Jun 2012 19:57:52 +0000
treeherdermozilla-beta@bbd8d5efd6d1 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerstbsaunde
bugs740958
milestone14.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 740958 - crash in nsAccessible::GetBounds, r=tbsaunde
accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
--- a/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
+++ b/accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp
@@ -96,16 +96,20 @@ nsHTMLWin32ObjectOwnerAccessible::CacheC
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsHTMLWin32ObjectAccessible
 ////////////////////////////////////////////////////////////////////////////////
 
 nsHTMLWin32ObjectAccessible::nsHTMLWin32ObjectAccessible(void* aHwnd):
 nsLeafAccessible(nsnull, nsnull)
 {
+  // XXX: Mark it as defunct to make sure no single nsAccessible method is
+  // running on it. We need to allow accessible without DOM nodes.
+  mFlags |= eIsDefunct;
+
   mHwnd = aHwnd;
   if (mHwnd) {
     // The plugin is not windowless. In this situation we use 
     // use its inner child owned by the plugin so that we don't get
     // in an infinite loop, where the WM_GETOBJECT's get forwarded
     // back to us and create another nsHTMLWin32ObjectAccessible
     HWND childWnd = ::GetWindow((HWND)aHwnd, GW_CHILD);
     if (childWnd) {