Attempted to fix crash in BrowserAccessibilityWin::RemoveBidirectionalRelation.

content/browser/accessibility/browser_accessibility_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/accessibility/browser_accessibility_win.h"
 
 #include <UIAutomationClient.h>
 #include <UIAutomationCoreApi.h>
 
 #include <algorithm>
@@ skipping 204 matching lines @@
   return instance->NewReference();
 }
 
 BrowserAccessibilityWin::BrowserAccessibilityWin()
     : win_attributes_(new WinAttributes()),
       previous_scroll_x_(0),
       previous_scroll_y_(0) {
 }
 
 BrowserAccessibilityWin::~BrowserAccessibilityWin() {
-  for (size_t i = 0; i < relations_.size(); ++i)
-    relations_[i]->Release();
+  ClearOwnRelations();
 }
 
 //
 // IAccessible methods.
 //
 // Conventions:
 // * Always test for instance_active() first and return E_FAIL if it's false.
 // * Always check for invalid arguments first, even if they're unused.
 // * Return S_FALSE if the only output is a string argument and it's empty.
 //
@@ skipping 4210 matching lines @@
   if (role == ui::AX_ROLE_MENU_LIST_OPTION &&
       parent_role == ui::AX_ROLE_MENU_LIST_POPUP) {
     return true;
   }
 
   return false;
 }
 
 void BrowserAccessibilityWin::AddRelation(const base::string16& relation_type,
                                           int target_id) {
+  // Reflexive relations don't need to be exposed through IA2.
+  if (target_id == GetId())
+    return;
+
   CComObject<BrowserAccessibilityRelation>* relation;
   HRESULT hr =
       CComObject<BrowserAccessibilityRelation>::CreateInstance(&relation);
   DCHECK(SUCCEEDED(hr));
   relation->AddRef();
   relation->Initialize(this, relation_type);
   relation->AddTarget(target_id);
   relations_.push_back(relation);
 }
 
 void BrowserAccessibilityWin::AddBidirectionalRelations(
     const base::string16& relation_type,
     const base::string16& reverse_relation_type,
     ui::AXIntListAttribute attribute) {
   if (!HasIntListAttribute(attribute))
     return;
 
+  const std::vector<int32_t>& attributes = GetIntListAttribute(attribute);

[dmazzoni, 2016/06/30 21:13:29]

How about "target_ids" and "filtered_target_ids" instead of "attributes" and
"filtered_attributes".

+  // Reflexive relations don't need to be exposed through IA2.
+  std::vector<int32_t> filtered_attributes;
+  int32_t current_id = GetId();
+  std::copy_if(attributes.begin(), attributes.end(),
+               std::back_inserter(filtered_attributes),
+               [current_id](int32_t id) { return id != current_id; });
+  if (filtered_attributes.empty())
+    return;
+
   CComObject<BrowserAccessibilityRelation>* relation;
   HRESULT hr =
       CComObject<BrowserAccessibilityRelation>::CreateInstance(&relation);
   DCHECK(SUCCEEDED(hr));
   relation->AddRef();
   relation->Initialize(this, relation_type);
 
-  for (int target_id : GetIntListAttribute(attribute)) {
+  for (int target_id : filtered_attributes) {
     BrowserAccessibilityWin* target =
         GetFromID(static_cast<int32_t>(target_id));
     if (!target || !target->instance_active())
       continue;
     relation->AddTarget(target_id);
     target->AddRelation(reverse_relation_type, GetId());
   }
 
   relations_.push_back(relation);
 }
@@ skipping 28 matching lines @@
     const base::string16& reverse_relation_type) {
   for (auto iter = relations_.begin(); iter != relations_.end();) {
     BrowserAccessibilityRelation* relation = *iter;
     DCHECK(relation);
     if (relation->get_type() == relation_type) {
       for (int target_id : relation->get_target_ids()) {
         BrowserAccessibilityWin* target =
             GetFromID(static_cast<int32_t>(target_id));
         if (!target || !target->instance_active())
           continue;
+        DCHECK_NE(target, this);
         target->RemoveTargetFromRelation(reverse_relation_type, GetId());
       }
+      iter = relations_.erase(iter);
       relation->Release();
-      iter = relations_.erase(iter);
     } else {
       ++iter;
     }
   }
 }
 
 void BrowserAccessibilityWin::RemoveTargetFromRelation(
     const base::string16& relation_type,
     int target_id) {
   for (auto iter = relations_.begin(); iter != relations_.end();) {
     BrowserAccessibilityRelation* relation = *iter;
     DCHECK(relation);
     if (relation->get_type() == relation_type) {
       // If |target_id| is not present, |RemoveTarget| will do nothing.
       relation->RemoveTarget(target_id);
     }
     if (relation->get_target_ids().empty()) {
+      iter = relations_.erase(iter);
       relation->Release();
-      iter = relations_.erase(iter);
     } else {
       ++iter;
     }
   }
 }
 
 void BrowserAccessibilityWin::UpdateRequiredAttributes() {
   // Expose slider value.
   if (ia_role() == ROLE_SYSTEM_PROGRESSBAR ||
       ia_role() == ROLE_SYSTEM_SCROLLBAR ||
@@ skipping 626 matching lines @@
   return static_cast<BrowserAccessibilityWin*>(obj);
 }
 
 const BrowserAccessibilityWin*
 ToBrowserAccessibilityWin(const BrowserAccessibility* obj) {
   DCHECK(!obj || obj->IsNative());
   return static_cast<const BrowserAccessibilityWin*>(obj);
 }
 
 }  // namespace content