Attempted to fix crash in BrowserAccessibilityWin::RemoveBidirectionalRelation.

content/browser/accessibility/browser_accessibility_win.cc

Index: content/browser/accessibility/browser_accessibility_win.cc
diff --git a/content/browser/accessibility/browser_accessibility_win.cc b/content/browser/accessibility/browser_accessibility_win.cc
index e82b7b39fb8ebd7659ccdc5c8004e30b90f82232..9729861ccd73096d771fa0363a4e3699be406bcc 100644
--- a/content/browser/accessibility/browser_accessibility_win.cc
+++ b/content/browser/accessibility/browser_accessibility_win.cc
@@ -222,8 +222,7 @@ BrowserAccessibilityWin::BrowserAccessibilityWin()
 }
 
 BrowserAccessibilityWin::~BrowserAccessibilityWin() {
-  for (size_t i = 0; i < relations_.size(); ++i)
-    relations_[i]->Release();
+  ClearOwnRelations();
 }
 
 //
@@ -4454,6 +4453,10 @@ bool BrowserAccessibilityWin::IsListBoxOptionOrMenuListOption() {
 
 void BrowserAccessibilityWin::AddRelation(const base::string16& relation_type,
                                           int target_id) {
+  // Reflexive relations don't need to be exposed through IA2.
+  if (target_id == GetId())
+    return;
+
   CComObject<BrowserAccessibilityRelation>* relation;
   HRESULT hr =
       CComObject<BrowserAccessibilityRelation>::CreateInstance(&relation);
@@ -4471,6 +4474,16 @@ void BrowserAccessibilityWin::AddBidirectionalRelations(
   if (!HasIntListAttribute(attribute))
     return;
 
+  const std::vector<int32_t>& attributes = GetIntListAttribute(attribute);

[dmazzoni, 2016/06/30 21:13:29]

How about "target_ids" and "filtered_target_ids" instead of "attributes" and
"filtered_attributes".

+  // Reflexive relations don't need to be exposed through IA2.
+  std::vector<int32_t> filtered_attributes;
+  int32_t current_id = GetId();
+  std::copy_if(attributes.begin(), attributes.end(),
+               std::back_inserter(filtered_attributes),
+               [current_id](int32_t id) { return id != current_id; });
+  if (filtered_attributes.empty())
+    return;
+
   CComObject<BrowserAccessibilityRelation>* relation;
   HRESULT hr =
       CComObject<BrowserAccessibilityRelation>::CreateInstance(&relation);
@@ -4478,7 +4491,7 @@ void BrowserAccessibilityWin::AddBidirectionalRelations(
   relation->AddRef();
   relation->Initialize(this, relation_type);
 
-  for (int target_id : GetIntListAttribute(attribute)) {
+  for (int target_id : filtered_attributes) {
     BrowserAccessibilityWin* target =
         GetFromID(static_cast<int32_t>(target_id));
     if (!target || !target->instance_active())
@@ -4527,10 +4540,11 @@ void BrowserAccessibilityWin::RemoveBidirectionalRelationsOfType(
             GetFromID(static_cast<int32_t>(target_id));
         if (!target || !target->instance_active())
           continue;
+        DCHECK_NE(target, this);
         target->RemoveTargetFromRelation(reverse_relation_type, GetId());
       }
-      relation->Release();
       iter = relations_.erase(iter);
+      relation->Release();
     } else {
       ++iter;
     }
@@ -4548,8 +4562,8 @@ void BrowserAccessibilityWin::RemoveTargetFromRelation(
       relation->RemoveTarget(target_id);
     }
     if (relation->get_target_ids().empty()) {
-      relation->Release();
       iter = relations_.erase(iter);
+      relation->Release();
     } else {
       ++iter;
     }