tor-browser

commit ec0aa566fa19398f7157fd77da8258599c5d91fe
parent 6d0b6a0b1647d3a18ec6d9ed49065c5140004504
Author: Eitan Isaacson <eitan@monotonous.org>
Date:   Wed, 19 Nov 2025 15:40:10 +0000

Bug 1996506 - Don't climb above document in GetNonGenericParent. r=Jamie

Also don't allow climbing into local accessibles off main thread, and
assert if we do.

Differential Revision: https://phabricator.services.mozilla.com/D272729

Diffstat:
M
accessible/basetypes/Accessible.h
 | 
5
+++--
M
accessible/ipc/DocAccessibleParent.h
 | 
7
++++++-

2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/accessible/basetypes/Accessible.h b/accessible/basetypes/Accessible.h
@@ -705,11 +705,12 @@ class Accessible {
   }
 
   /**
-   * Returns the nearest ancestor which is not a generic element.
+   * Returns the nearest ancestor in the document which is not a generic
+   * element.
    */
   Accessible* GetNonGenericParent() const {
     for (Accessible* parent = Parent(); parent; parent = parent->Parent()) {
-      if (!parent->IsGeneric()) {
+      if (parent->IsDoc() || !parent->IsGeneric()) {
         return parent;
       }
     }
diff --git a/accessible/ipc/DocAccessibleParent.h b/accessible/ipc/DocAccessibleParent.h
@@ -233,7 +233,12 @@ class DocAccessibleParent : public RemoteAccessible,
   // Accessible
   virtual Accessible* Parent() const override {
     if (IsTopLevel()) {
-      return OuterDocOfRemoteBrowser();
+      if (NS_IsMainThread()) {
+        return OuterDocOfRemoteBrowser();
+      } else {
+        MOZ_ASSERT_UNREACHABLE("Getting local parent off main thread!");
+        return nullptr;
+      }
     }
     return RemoteParent();
   }