Bug 1748775 - Expire column children when table expires. r=morgan, a=RyanVM

I think there is a potential crasher if an AT holds a reference to a column object while its parent table expires, and then tries to retrieve AXChildren. We need to expire te column objects when the table expires or is destroyed.

Differential Revision: https://phabricator.services.mozilla.com/D136288

accessible/mac/mozTableAccessible.h

@@ -77,6 +77,9 @@
 // override
 - (void)dealloc;
 
+// override
+- (void)expire;
+
 // override
 - (NSNumber*)moxRowCount;
 

accessible/mac/mozTableAccessible.mm

@@ -227,6 +227,11 @@ enum CachedBool { eCachedBoolMiss, eCachedTrue, eCachedFalse };
   NS_OBJC_END_TRY_IGNORE_BLOCK;
 }
 
+- (void)expire {
+  [self invalidateColumns];
+  [super expire];
+}
+
 - (NSNumber*)moxRowCount {
   MOZ_ASSERT(mGeckoAccessible);
 
@@ -365,6 +370,9 @@ enum CachedBool { eCachedBoolMiss, eCachedTrue, eCachedFalse };
 - (void)invalidateColumns {
   NS_OBJC_BEGIN_TRY_IGNORE_BLOCK;
   if (mColContainers) {
+    for (mozColumnContainer* col in mColContainers) {
+      [col expire];
+    }
     [mColContainers release];
     mColContainers = nil;
   }

accessible/tests/browser/mac/browser_table.js

@@ -163,6 +163,22 @@ addAccessibleTask(
       1,
       "Last column has single child"
     );
+
+    reorder = waitForEvent(
+      EVENT_REORDER,
+      e => e.accessible.role == ROLE_DOCUMENT
+    );
+    await SpecialPowers.spawn(browser, [], () => {
+      content.document.getElementById("customers").remove();
+    });
+    await reorder;
+
+    try {
+      cols[0].getAttributeValue("AXChildren");
+      ok(false, "Getting children from column of expired table should fail");
+    } catch (e) {
+      ok(true, "Getting children from column of expired table should fail");
+    }
   }
 );