Bug 1336971 - Ensure that we always re-examine the length of the top-level remote doc array to pick up any changes due to mutation. r=Jamie, a=ritu
authorAaron Klotz <aklotz@mozilla.com>
Mon, 30 Oct 2017 14:52:00 -0600
changeset 435307 05e050d6c86867f19590b72a6131713df81044aa
parent 435306 84af2700ac30dfc0e80759c17f66b46b9733021b
child 435308 d57f1c698b4e2930c64d4beeceb294b0184aae31
push id1567
push userjlorenzo@mozilla.com
push dateThu, 02 Nov 2017 12:36:05 +0000
treeherdermozilla-release@e512c14a0406 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersJamie, ritu
bugs1336971
milestone57.0
Bug 1336971 - Ensure that we always re-examine the length of the top-level remote doc array to pick up any changes due to mutation. r=Jamie, a=ritu MozReview-Commit-ID: BLq1zzyKs9e
accessible/windows/msaa/AccessibleWrap.cpp
--- a/accessible/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/windows/msaa/AccessibleWrap.cpp
@@ -1515,18 +1515,20 @@ AccessibleWrap::GetRemoteIAccessibleFor(
   const nsTArray<DocAccessibleParent*>* remoteDocs =
     DocManager::TopLevelRemoteDocs();
   if (!remoteDocs) {
     return nullptr;
   }
 
   RefPtr<IAccessible> result;
 
-  size_t docCount = remoteDocs->Length();
-  for (size_t i = 0; i < docCount; i++) {
+  // We intentionally leave the call to remoteDocs->Length() inside the loop
+  // condition because it is possible for reentry to occur in the call to
+  // GetProxiedAccessibleInSubtree() such that remoteDocs->Length() is mutated.
+  for (size_t i = 0; i < remoteDocs->Length(); i++) {
     DocAccessibleParent* remoteDoc = remoteDocs->ElementAt(i);
 
     uint32_t remoteDocMsaaId = WrapperFor(remoteDoc)->GetExistingID();
     if (!sIDGen.IsSameContentProcessFor(aVarChild.lVal, remoteDocMsaaId)) {
       continue;
     }
 
     Accessible* outerDoc = remoteDoc->OuterDocOfRemoteBrowser();