Bug 1860001: Handle invalid events. r=eeejay

Differential Revision: https://phabricator.services.mozilla.com/D191601

accessible/ipc/DocAccessibleParent.cpp

@@ -348,6 +348,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvEvent(
   if (mShutdown) {
     return IPC_OK();
   }
+  if (aEventType == 0 || aEventType >= nsIAccessibleEvent::EVENT_LAST_ENTRY) {
+    MOZ_ASSERT_UNREACHABLE("Invalid event");
+    return IPC_FAIL(this, "Invalid event");
+  }
 
   RemoteAccessible* remote = GetAccessible(aID);
   if (!remote) {
@@ -516,6 +520,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvSelectionEvent(
   if (mShutdown) {
     return IPC_OK();
   }
+  if (aType == 0 || aType >= nsIAccessibleEvent::EVENT_LAST_ENTRY) {
+    MOZ_ASSERT_UNREACHABLE("Invalid event");
+    return IPC_FAIL(this, "Invalid event");
+  }
 
   RemoteAccessible* target = GetAccessible(aID);
   RemoteAccessible* widget = GetAccessible(aWidgetID);
@@ -584,6 +592,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvScrollingEvent(
   if (mShutdown) {
     return IPC_OK();
   }
+  if (aType == 0 || aType >= nsIAccessibleEvent::EVENT_LAST_ENTRY) {
+    MOZ_ASSERT_UNREACHABLE("Invalid event");
+    return IPC_FAIL(this, "Invalid event");
+  }
 
   RemoteAccessible* target = GetAccessible(aID);
   if (!target) {
@@ -762,6 +774,10 @@ mozilla::ipc::IPCResult DocAccessibleParent::RecvRoleChangedEvent(
   if (mShutdown) {
     return IPC_OK();
   }
+  if (!aria::IsRoleMapIndexValid(aRoleMapEntryIndex)) {
+    MOZ_ASSERT_UNREACHABLE("Invalid role map entry index");
+    return IPC_FAIL(this, "Invalid role map entry index");
+  }
 
   mRole = aRole;
   mRoleMapEntryIndex = aRoleMapEntryIndex;

accessible/windows/msaa/MsaaAccessible.cpp

@@ -215,8 +215,10 @@ void MsaaAccessible::FireWinEvent(Accessible* aTarget, uint32_t aEventType) {
                     nsIAccessibleEvent::EVENT_LAST_ENTRY,
                 "MSAA event map skewed");
 
-  NS_ASSERTION(aEventType > 0 && aEventType < ArrayLength(gWinEventMap),
-               "invalid event type");
+  if (aEventType == 0 || aEventType >= ArrayLength(gWinEventMap)) {
+    MOZ_ASSERT_UNREACHABLE("invalid event type");
+    return;
+  }
 
   uint32_t winEvent = gWinEventMap[aEventType];
   if (!winEvent) return;