Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 22:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1691930 - Check that FocusedChild is bound to a doc in RecvFocusedChild. r=Jamie

Browse Source 
Added an assert in focus manager. Hopefully fuzzers will help us find
cases where the active item is defunct, if that is indeed what is
happening.

Differential Revision: https://phabricator.services.mozilla.com/D109403
This commit is contained in:
Eitan Isaacson 2021-03-24 16:24:47 +00:00
parent 69a199700d
commit f4238ee721
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
accessible/base/FocusManager.cpp
View File

@ -28,7 +28,14 @@ FocusManager::FocusManager() {}
FocusManager::~FocusManager() {}
LocalAccessible* FocusManager::FocusedAccessible() const {
if (mActiveItem) return mActiveItem;
if (mActiveItem) {
if (mActiveItem->IsDefunct()) {
MOZ_ASSERT_UNREACHABLE("Stored active item is unbound from document");
return nullptr;
}
return mActiveItem;
}
nsINode* focusedNode = FocusedDOMNode();
if (focusedNode) {

5
accessible/ipc/other/DocAccessibleChild.cpp
View File

@ -1542,6 +1542,11 @@ mozilla::ipc::IPCResult DocAccessibleChild::RecvFocusedChild(
// document, not just a descendant of the caller's document. Check that it
// is really a descendant.
DocAccessible* doc = result->Document();
if (!doc) {
MOZ_ASSERT_UNREACHABLE("Focused child is unbound from doc.");
return IPC_OK();
}
while (doc != mDoc) {
doc = doc->ParentDocument();
if (!doc) {