Fix a possible renderer hang due to an WebAccessibilityObject becoming invalid.

content/renderer/renderer_accessibility.cc

Index: content/renderer/renderer_accessibility.cc
diff --git a/content/renderer/renderer_accessibility.cc b/content/renderer/renderer_accessibility.cc
index 2ca15dd012f7e7e2d81f324b3c473671c7bbd8f0..a4a42a9790a1fa53ffa2cc629fdfe83d353b99a3 100644
--- a/content/renderer/renderer_accessibility.cc
+++ b/content/renderer/renderer_accessibility.cc
@@ -213,14 +213,6 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
     WebAccessibilityObject obj = document.accessibilityObjectFromID(
         notification.id);
 
-    if (!obj.isValid()) {
-#ifndef NDEBUG
-      if (logging_)
-        LOG(WARNING) << "Got notification on invalid object id " << obj.axID();
-#endif
-      continue;
-    }
-
     // The browser may not have this object yet, for example if we get a
     // notification on an object that was recently added, or if we get a
     // notification on a node before the page has loaded. Work our way
@@ -228,6 +220,7 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
     // we reach the root.
     int root_id = document.accessibilityObject().axID();
     while (browser_id_map_.find(obj.axID()) == browser_id_map_.end() &&
+           obj.isValid() &&
            obj.axID() != root_id) {
       obj = obj.parentObject();
       includes_children = true;
@@ -237,6 +230,14 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
       }
     }
 
+    if (!obj.isValid()) {
+#ifndef NDEBUG
+      if (logging_)
+        LOG(WARNING) << "Got notification on invalid object id " << obj.axID();

[dmazzoni, 2011/12/01 18:59:56]

Maybe the warning should say that the we got a notification on an invalid object
OR the descendant of an invalid object?

[David Tseng, 2011/12/01 19:48:57]

Done.

+#endif
+      continue;
+    }
+
     // Another potential problem is that this notification may be on an
     // object that is detached from the tree. Determine if this node is not a
     // child of its parent, and if so move the notification to the parent.
@@ -244,8 +245,12 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
     // https://bugs.webkit.org/show_bug.cgi?id=68466 is fixed.
     if (obj.axID() != root_id) {
       WebAccessibilityObject parent = obj.parentObject();
-      while (!parent.isNull() && parent.accessibilityIsIgnored())
+      while (!parent.isNull() &&
+             parent.isValid() &&
+             parent.accessibilityIsIgnored()) {
         parent = parent.parentObject();
+      }
+
       if (parent.isNull()) {

[dmazzoni, 2011/12/01 18:59:56]

I think if parent is null or invalid we should continue and not send a
notification, otherwise the code below will likely send the notification on the
invalid parent. Though that probably won't lead to a crash, so it's not as
critical.

[David Tseng, 2011/12/01 19:48:57]

Done.

         NOTREACHED();
       }