Fix crash when system retains an accessibility object.

content/browser/accessibility/browser_accessibility_mac_unittest.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 
 #include "base/memory/scoped_ptr.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/browser/accessibility/browser_accessibility_cocoa.h"
@@ skipping 40 matching lines @@
 }
 
 @end
 
 namespace content {
 
 class BrowserAccessibilityTest : public ui::CocoaTest {
  public:
   virtual void SetUp() {
     CocoaTest::SetUp();
+    RebuildAccessibilityTree();
+  }
+
+ protected:
+  void RebuildAccessibilityTree() {
     AccessibilityNodeData root;
     root.id = 1000;
     root.location.set_width(500);
     root.location.set_height(100);
     root.role = AccessibilityNodeData::ROLE_ROOT_WEB_AREA;
     root.string_attributes[AccessibilityNodeData::ATTR_HELP] =
         ASCIIToUTF16("HelpText");
     root.child_ids.push_back(1001);
     root.child_ids.push_back(1002);
 
@@ skipping 12 matching lines @@
     child2.role = AccessibilityNodeData::ROLE_HEADING;
 
     delegate_.reset([[MockAccessibilityDelegate alloc] init]);
     manager_.reset(
         new BrowserAccessibilityManagerMac(delegate_, root, NULL));
     manager_->UpdateNodesForTesting(child1, child2);
     accessibility_.reset([manager_->GetRoot()->ToBrowserAccessibilityCocoa()
         retain]);
   }
 
- protected:
   scoped_nsobject<MockAccessibilityDelegate> delegate_;
   scoped_nsobject<BrowserAccessibilityCocoa> accessibility_;
   scoped_ptr<BrowserAccessibilityManager> manager_;
 };
 
 // Standard hit test.
 TEST_F(BrowserAccessibilityTest, HitTestTest) {
   BrowserAccessibilityCocoa* firstChild =
       [accessibility_ accessibilityHitTest:NSMakePoint(50, 50)];
   EXPECT_NSEQ(@"Child1",
@@ skipping 25 matching lines @@
   EXPECT_NSEQ(@"HelpText", helpText);
 }
 
 // Test querying for an invalid attribute to ensure it doesn't crash.
 TEST_F(BrowserAccessibilityTest, InvalidAttributeTest) {
   NSString* shouldBeNil = [accessibility_
       accessibilityAttributeValue:@"NSAnInvalidAttribute"];
   EXPECT_TRUE(shouldBeNil == nil);
 }
 
+TEST_F(BrowserAccessibilityTest, RetainedDetachedObjectsReturnNil) {
+  // Get the first child.
+  BrowserAccessibilityCocoa* retainedFirstChild =
+      [accessibility_ accessibilityHitTest:NSMakePoint(50, 50)];
+  EXPECT_NSEQ(@"Child1", [retainedFirstChild
+      accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+
+  // Retain it. This simulates what the system might do with an
+  // accessibility object.
+  [retainedFirstChild retain];
+
+  // Rebuild the accessibility tree, which should detach |retainedFirstChild|.
+  RebuildAccessibilityTree();
+
+  // Now any attributes we query should return nil.
+  EXPECT_EQ(nil, [retainedFirstChild
+      accessibilityAttributeValue:NSAccessibilityTitleAttribute]);
+
+  // Don't leak memory in the test.
+  [retainedFirstChild release];
+}
+
 }  // namespace content