Fix crash when system retains an accessibility object.

content/browser/accessibility/browser_accessibility_cocoa.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <execinfo.h>
 
 #import "content/browser/accessibility/browser_accessibility_cocoa.h"
 
 #include <map>
 
@@ skipping 1403 matching lines @@
 // Returns the deepest accessibility child that should not be ignored.
 // It is assumed that the hit test has been narrowed down to this object
 // or one of its children, so this will never return nil unless this
 // object is invalid.
 - (id)accessibilityHitTest:(NSPoint)point {
   if (!browserAccessibility_)
     return nil;
 
   BrowserAccessibilityCocoa* hit = self;
   for (BrowserAccessibilityCocoa* child in [self children]) {
+    if (!child)

[dmazzoni, 2013/11/05 16:44:32]

This doesn't look right, I don't see how |child| should ever be null.

The issue fixed by the previous change was that BrowserAccessibilityCocoa's
browserAccessibility_ pointer becomes NULL - I don't see how we should ever have
a pointer to a NULL child...

+      continue;
     NSPoint origin = [child origin];
     NSSize size = [[child size] sizeValue];
     NSRect rect;
     rect.origin = origin;
     rect.size = size;
     if (NSPointInRect(point, rect)) {
       hit = child;
       id childResult = [child accessibilityHitTest:point];
       if (![childResult accessibilityIsIgnored]) {

[dmazzoni, 2013/11/05 16:44:32]

I think childResult could be nil here. Is that the actual bug?

         hit = childResult;
         break;
       }
     }
   }
   return NSAccessibilityUnignoredAncestor(hit);
 }
 
 - (BOOL)isEqual:(id)object {
   if (![object isKindOfClass:[BrowserAccessibilityCocoa class]])
     return NO;
   return ([self hash] == [object hash]);
 }
 
 - (NSUInteger)hash {
   // Potentially called during dealloc.
   if (!browserAccessibility_)
     return [super hash];
   return browserAccessibility_->renderer_id();
 }
 
 - (BOOL)accessibilityShouldUseUniqueId {
   return YES;
 }
 
 @end