Bug 1303526 - Crash in mozilla::a11y::DocAccessible::ProcessInvalidationList. r=yzen, a=gchang
authorAlexander Surkov <surkov.alexander@gmail.com>
Fri, 23 Sep 2016 16:57:16 -0400
changeset 355791 fef3ee4668579fc66566c77f240f1c0e10dba886
parent 355790 d2a4f2fc6716a1ba6e78c93342eac761f7524599
child 355792 1283217c5463dc3206ec563f3609809a1da3275d
push id6570
push userraliiev@mozilla.com
push dateMon, 14 Nov 2016 12:26:13 +0000
treeherdermozilla-beta@f455459b2ae5 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen, gchang
bugs1303526
milestone51.0a2
Bug 1303526 - Crash in mozilla::a11y::DocAccessible::ProcessInvalidationList. r=yzen, a=gchang
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -1370,17 +1370,17 @@ DocAccessible::RecreateAccessible(nsICon
 void
 DocAccessible::ProcessInvalidationList()
 {
   // Invalidate children of container accessible for each element in
   // invalidation list. Allow invalidation list insertions while container
   // children are recached.
   for (uint32_t idx = 0; idx < mInvalidationList.Length(); idx++) {
     nsIContent* content = mInvalidationList[idx];
-    if (!HasAccessible(content)) {
+    if (!HasAccessible(content) && content->HasID()) {
       Accessible* container = GetContainerAccessible(content);
       if (container) {
         // Check if the node is a target of aria-owns, and if so, don't process
         // it here and let DoARIAOwnsRelocation process it.
         AttrRelProviderArray* list =
           mDependentIDsHash.Get(nsDependentAtomString(content->GetID()));
         bool shouldProcess = !!list;
         if (shouldProcess) {