Fix crash when system retains an accessibility object.

content/browser/accessibility/browser_accessibility_cocoa.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <execinfo.h>
 
 #import "content/browser/accessibility/browser_accessibility_cocoa.h"
 
 #include <map>
 
@@ skipping 326 matching lines @@
 
 - (id)initWithObject:(BrowserAccessibility*)accessibility
             delegate:(id<BrowserAccessibilityDelegateCocoa>)delegate {
   if ((self = [super init])) {
     browserAccessibility_ = accessibility;
     delegate_ = delegate;
   }
   return self;
 }
 
-// Deletes our associated BrowserAccessibilityMac.
-- (void)dealloc {
+- (void)detach {
   if (browserAccessibility_) {
     NSAccessibilityUnregisterUniqueIdForUIElement(self);
-    delete browserAccessibility_;
     browserAccessibility_ = NULL;
   }
-
-  [super dealloc];
 }
 
 - (NSString*)accessKey {
   return NSStringForStringAttribute(
       browserAccessibility_->string_attributes(),
       AccessibilityNodeData::ATTR_ACCESS_KEY);
 }
 
 - (NSNumber*)ariaAtomic {
   bool boolValue = false;
@@ skipping 624 matching lines @@
   return [delegate_ window];
 }
 
 - (NSString*)methodNameForAttribute:(NSString*)attribute {
   return [attributeToMethodNameMap objectForKey:attribute];
 }
 
 // Returns the accessibility value for the given attribute.  If the value isn't
 // supported this will return nil.
 - (id)accessibilityAttributeValue:(NSString*)attribute {
+  if (!browserAccessibility_)
+    return nil;
+
   SEL selector =
       NSSelectorFromString([self methodNameForAttribute:attribute]);
   if (selector)
     return [self performSelector:selector];
 
   // TODO(dtseng): refactor remaining attributes.
   int selStart, selEnd;
   if (browserAccessibility_->GetIntAttribute(
           AccessibilityNodeData::ATTR_TEXT_SEL_START, &selStart) &&
       browserAccessibility_->
@@ skipping 19 matching lines @@
       return [NSValue valueWithRange:NSMakeRange(selStart, selLength)];
     }
   }
   return nil;
 }
 
 // Returns the accessibility value for the given attribute and parameter. If the
 // value isn't supported this will return nil.
 - (id)accessibilityAttributeValue:(NSString*)attribute
                      forParameter:(id)parameter {
+  if (!browserAccessibility_)
+    return nil;
+
   const std::vector<int32>& line_breaks = browserAccessibility_->line_breaks();
   int len = static_cast<int>(browserAccessibility_->value().size());
 
   if ([attribute isEqualToString:
       NSAccessibilityStringForRangeParameterizedAttribute]) {
     NSRange range = [(NSValue*)parameter rangeValue];
     return base::SysUTF16ToNSString(
         browserAccessibility_->value().substr(range.location, range.length));
   }
 
@@ skipping 87 matching lines @@
       [attribute isEqualTo:
           NSAccessibilityStyleRangeForIndexParameterizedAttribute]) {
     return nil;
   }
   return nil;
 }
 
 // Returns an array of parameterized attributes names that this object will
 // respond to.
 - (NSArray*)accessibilityParameterizedAttributeNames {
+  if (!browserAccessibility_)
+    return nil;
+
   if ([[self role] isEqualToString:NSAccessibilityTableRole] ||
       [[self role] isEqualToString:NSAccessibilityGridRole]) {
     return [NSArray arrayWithObjects:
         NSAccessibilityCellForColumnAndRowParameterizedAttribute,
         nil];
   }
   if ([[self role] isEqualToString:NSAccessibilityTextFieldRole] ||
       [[self role] isEqualToString:NSAccessibilityTextAreaRole]) {
     return [NSArray arrayWithObjects:
         NSAccessibilityLineForIndexParameterizedAttribute,
         NSAccessibilityRangeForLineParameterizedAttribute,
         NSAccessibilityStringForRangeParameterizedAttribute,
         NSAccessibilityRangeForPositionParameterizedAttribute,
         NSAccessibilityRangeForIndexParameterizedAttribute,
         NSAccessibilityBoundsForRangeParameterizedAttribute,
         NSAccessibilityRTFForRangeParameterizedAttribute,
         NSAccessibilityAttributedStringForRangeParameterizedAttribute,
         NSAccessibilityStyleRangeForIndexParameterizedAttribute,
         nil];
   }
   return nil;
 }
 
 // Returns an array of action names that this object will respond to.
 - (NSArray*)accessibilityActionNames {
+  if (!browserAccessibility_)
+    return nil;
+
   NSMutableArray* ret =
       [NSMutableArray arrayWithObject:NSAccessibilityShowMenuAction];
   NSString* role = [self role];
   // TODO(dtseng): this should only get set when there's a default action.
   if (![role isEqualToString:NSAccessibilityStaticTextRole] &&
       ![role isEqualToString:NSAccessibilityTextAreaRole] &&
       ![role isEqualToString:NSAccessibilityTextFieldRole]) {
     [ret addObject:NSAccessibilityPressAction];
   }
 
   return ret;
 }
 
 // Returns a sub-array of values for the given attribute value, starting at
 // index, with up to maxCount items.  If the given index is out of bounds,
 // or there are no values for the given attribute, it will return nil.
 // This method is used for querying subsets of values, without having to
 // return a large set of data, such as elements with a large number of
 // children.
 - (NSArray*)accessibilityArrayAttributeValues:(NSString*)attribute
                                         index:(NSUInteger)index
                                      maxCount:(NSUInteger)maxCount {
+  if (!browserAccessibility_)
+    return nil;
+
   NSArray* fullArray = [self accessibilityAttributeValue:attribute];
   if (!fullArray)
     return nil;
   NSUInteger arrayCount = [fullArray count];
   if (index >= arrayCount)
     return nil;
   NSRange subRange;
   if ((index + maxCount) > arrayCount) {
     subRange = NSMakeRange(index, arrayCount - index);
   } else {
     subRange = NSMakeRange(index, maxCount);
   }
   return [fullArray subarrayWithRange:subRange];
 }
 
 // Returns the count of the specified accessibility array attribute.
 - (NSUInteger)accessibilityArrayAttributeCount:(NSString*)attribute {
+  if (!browserAccessibility_)
+    return nil;
+
   NSArray* fullArray = [self accessibilityAttributeValue:attribute];
   return [fullArray count];
 }
 
 // Returns the list of accessibility attributes that this object supports.
 - (NSArray*)accessibilityAttributeNames {
+  if (!browserAccessibility_)
+    return nil;
+
   // General attributes.
   NSMutableArray* ret = [NSMutableArray arrayWithObjects:
       NSAccessibilityChildrenAttribute,
       NSAccessibilityDescriptionAttribute,
       NSAccessibilityEnabledAttribute,
       NSAccessibilityFocusedAttribute,
       NSAccessibilityHelpAttribute,
       NSAccessibilityParentAttribute,
       NSAccessibilityPositionAttribute,
       NSAccessibilityRoleAttribute,
@@ skipping 115 matching lines @@
     [ret addObjectsFromArray:[NSArray arrayWithObjects:
          NSAccessibilityTitleUIElementAttribute,
          nil]];
   }
 
   return ret;
 }
 
 // Returns the index of the child in this objects array of children.
 - (NSUInteger)accessibilityGetIndexOf:(id)child {
+  if (!browserAccessibility_)
+    return nil;
+
   NSUInteger index = 0;
   for (BrowserAccessibilityCocoa* childToCheck in [self children]) {
     if ([child isEqual:childToCheck])
       return index;
     ++index;
   }
   return NSNotFound;
 }
 
 // Returns whether or not the specified attribute can be set by the
 // accessibility API via |accessibilitySetValue:forAttribute:|.
 - (BOOL)accessibilityIsAttributeSettable:(NSString*)attribute {
+  if (!browserAccessibility_)
+    return nil;
+
   if ([attribute isEqualToString:NSAccessibilityFocusedAttribute])
     return GetState(browserAccessibility_,
         AccessibilityNodeData::STATE_FOCUSABLE);
   if ([attribute isEqualToString:NSAccessibilityValueAttribute]) {
     bool canSetValue = false;
     browserAccessibility_->GetBoolAttribute(
         AccessibilityNodeData::ATTR_CAN_SET_VALUE, &canSetValue);
     return canSetValue;
   }
   if ([attribute isEqualToString:NSAccessibilitySelectedTextRangeAttribute] &&
       ([[self role] isEqualToString:NSAccessibilityTextFieldRole] ||
        [[self role] isEqualToString:NSAccessibilityTextAreaRole]))
     return YES;
 
   return NO;
 }
 
 // Returns whether or not this object should be ignored in the accessibilty
 // tree.
 - (BOOL)accessibilityIsIgnored {
+  if (!browserAccessibility_)
+    return true;
+
   return [self isIgnored];
 }
 
 // Performs the given accessibilty action on the webkit accessibility object
 // that backs this object.
 - (void)accessibilityPerformAction:(NSString*)action {
+  if (!browserAccessibility_)
+    return;
+
   // TODO(feldstein): Support more actions.
   if ([action isEqualToString:NSAccessibilityPressAction])
     [delegate_ doDefaultAction:browserAccessibility_->renderer_id()];
   else if ([action isEqualToString:NSAccessibilityShowMenuAction])
     [delegate_ performShowMenuAction:self];
 }
 
 // Returns the description of the given action.
 - (NSString*)accessibilityActionDescription:(NSString*)action {
+  if (!browserAccessibility_)
+    return nil;
+
   return NSAccessibilityActionDescription(action);
 }
 
 // Sets an override value for a specific accessibility attribute.
 // This class does not support this.
 - (BOOL)accessibilitySetOverrideValue:(id)value
                          forAttribute:(NSString*)attribute {
   return NO;
 }
 
 // Sets the value for an accessibility attribute via the accessibility API.
 - (void)accessibilitySetValue:(id)value forAttribute:(NSString*)attribute {
+  if (!browserAccessibility_)
+    return;
+
   if ([attribute isEqualToString:NSAccessibilityFocusedAttribute]) {
     NSNumber* focusedNumber = value;
     BOOL focused = [focusedNumber intValue];
     [delegate_ setAccessibilityFocus:focused
                      accessibilityId:browserAccessibility_->renderer_id()];
   }
   if ([attribute isEqualToString:NSAccessibilitySelectedTextRangeAttribute]) {
     NSRange range = [(NSValue*)value rangeValue];
     [delegate_
         accessibilitySetTextSelection:browserAccessibility_->renderer_id()
         startOffset:range.location
         endOffset:range.location + range.length];
   }
 }
 
 // Returns the deepest accessibility child that should not be ignored.
 // It is assumed that the hit test has been narrowed down to this object
-// or one of its children, so this will never return nil.
+// or one of its children, so this will never return nil unless this
+// object is invalid.
 - (id)accessibilityHitTest:(NSPoint)point {
+  if (!browserAccessibility_)
+    return nil;
+
   BrowserAccessibilityCocoa* hit = self;
   for (BrowserAccessibilityCocoa* child in [self children]) {
     NSPoint origin = [child origin];
     NSSize size = [[child size] sizeValue];
     NSRect rect;
     rect.origin = origin;
     rect.size = size;
     if (NSPointInRect(point, rect)) {
       hit = child;
       id childResult = [child accessibilityHitTest:point];
@@ skipping 18 matching lines @@
     return [super hash];
   return browserAccessibility_->renderer_id();
 }
 
 - (BOOL)accessibilityShouldUseUniqueId {
   return YES;
 }
 
 @end