Bug 1485097: When handling aria-owns relocation and an owned child doesn't yet have an accessible, skip it if the owned child is actually an ancestor of its owner. r=surkov

This can easily be reproduced if the ancestor being owned has role="presentation", but there are other cases as well.
If we don't prevent this, we end up with a loop.

Differential Revision: https://phabricator.services.mozilla.com/D4051

--HG--
extra : moz-landing-system : lando

accessible/generic/DocAccessible.cpp

@@ -19,6 +19,7 @@
 #include "TreeWalker.h"
 #include "xpcAccessibleDocument.h"
 
+#include "nsContentUtils.h"
 #include "nsIMutableArray.h"
 #include "nsICommandManager.h"
 #include "nsIDocShell.h"
@@ -2089,6 +2090,11 @@ DocAccessible::DoARIAOwnsRelocation(Accessible* aOwner)
 
     // Make an attempt to create an accessible if it wasn't created yet.
     if (!child) {
+      // An owned child cannot be an ancestor of the owner.
+      if (nsContentUtils::ContentIsDescendantOf(aOwner->Elm(), childEl)) {
+        continue;
+      }
+
       if (aOwner->IsAcceptableChild(childEl)) {
         child = GetAccService()->CreateAccessible(childEl, aOwner);
         if (child) {

accessible/tests/mochitest/tree/test_aria_owns.html

@@ -117,6 +117,12 @@
         ] };
       testAccessibleTree("grid", tree);
 
+      tree =
+        { SECTION: [ // presentation_owner
+          // Can't own ancestor, so no children.
+        ] };
+      testAccessibleTree("presentation_owner", tree);
+
       SimpleTest.finish();
     }
 
@@ -181,6 +187,12 @@
     <div role="gridcell">cell 2,1</div>
     <div role="gridcell">cell 2,2</div>
   </div>
+
+  <!-- Owned child which is an ancestor of its owner but didn't yet exist when
+       aria-owns relocation was processed (bug 1485097). -->
+  <div id="presentation" role="presentation">
+    <div id="presentation_owner" aria-owns="presentation"></div>
+  </div>
 </body>
 
 </html>