From cf9e5cbbc1fda73a36609a06e7f77f5a51468c46 Mon Sep 17 00:00:00 2001 From: David Parks Date: Mon, 22 May 2017 02:09:02 -0700 Subject: [PATCH] Bug 1330484 - Part 1: Detect and Shutdown binding accessibles that have lost their actors. r=jimm In content processes, we want to avoid a situation where a DocAccessible has lost its IPC actor (DocAccessibleChild) but finds itself processing a delayed request to take on child documents. In this case, we shut down the child documents as they are no longer valid. --- accessible/base/NotificationController.cpp | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/accessible/base/NotificationController.cpp b/accessible/base/NotificationController.cpp index 529e29f98f3f..287b81186cc0 100644 --- a/accessible/base/NotificationController.cpp +++ b/accessible/base/NotificationController.cpp @@ -730,7 +730,9 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime) } mContentInsertions.Clear(); - // Bind hanging child documents. + // Bind hanging child documents unless we are using IPC and the + // document has no IPC actor. If we fail to bind the child doc then + // shut it down. uint32_t hangingDocCnt = mHangingChildDocuments.Length(); nsTArray> newChildDocs; for (uint32_t idx = 0; idx < hangingDocCnt; idx++) { @@ -738,6 +740,11 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime) if (childDoc->IsDefunct()) continue; + if (IPCAccessibilityActive() && !mDocument->IPCDoc()) { + childDoc->Shutdown(); + continue; + } + nsIContent* ownerContent = mDocument->DocumentNode()-> FindContentForSubDocument(childDoc->DocumentNode()); if (ownerContent) { @@ -755,6 +762,8 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime) childDoc->Shutdown(); } } + + // Clear the hanging documents list, even if we didn't bind them. mHangingChildDocuments.Clear(); MOZ_ASSERT(mDocument, "Illicit document shutdown"); if (!mDocument) {