Bug 1205476 - crash in mozilla::a11y::DocAccessible::ProcessInvalidationList, part2, r=davidb

This commit is contained in:
Alexander Surkov 2015-09-21 12:47:02 -04:00
parent 3301b277a1
commit f78dc55625

View File

@ -1348,12 +1348,12 @@ DocAccessible::ProcessInvalidationList()
// Alter the tree according to aria-owns (seize the trees).
for (uint32_t idx = 0; idx < mARIAOwnsInvalidationList.Length(); idx++) {
Accessible* owner = mARIAOwnsInvalidationList[idx].mOwner;
if (owner->IsDefunct()) { // eventually died until we've got here
if (!owner->IsInDocument()) { // eventually died before we've got here
continue;
}
Accessible* child = GetAccessible(mARIAOwnsInvalidationList[idx].mChild);
if (!child) {
if (!child || !child->IsInDocument()) {
continue;
}