Bug 1509234: Return early if accessible dies while processing a focus event to prevent crashes. r=eeejay

In FocusManager::ProcessFocusEvent, after firing the event, we get the anchor jump from the target Accessible's document.
However, it seems the Accessible can be shut down during the call to nsEventShell::FireEvent, resulting in a crash when we try to get the anchor jump.
Protect against this by checking whether the target is defunct after firing the event.

Differential Revision: https://phabricator.services.mozilla.com/D39450

--HG--
extra : moz-landing-system : lando

accessible/base/FocusManager.cpp

@@ -348,10 +348,14 @@ void FocusManager::ProcessFocusEvent(AccEvent* aEvent) {
   nsEventShell::FireEvent(focusEvent);
   mLastFocus = target;
 
+  if (NS_WARN_IF(target->IsDefunct())) {
+    // target died during nsEventShell::FireEvent.
+    return;
+  }
+
   // Fire scrolling_start event when the document receives the focus if it has
   // an anchor jump. If an accessible within the document receive the focus
   // then null out the anchor jump because it no longer applies.
-  MOZ_ASSERT(!target->IsDefunct());
   DocAccessible* targetDocument = target->Document();
   MOZ_ASSERT(targetDocument);
   Accessible* anchorJump = targetDocument->AnchorJump();