Fix case where BrowserAccessibilityManagerWin is deleted before AccessibleHWND

Also adds a unit test and enables unit tests that should have been running
on Aura previously.

BUG=327354
TBR=jam

Review URL: https://codereview.chromium.org/103243004

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@240502 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 16 insertions, 2 deletions

diff --git a/content/browser/accessibility/browser_accessibility_manager_win.cc b/content/browser/accessibility/browser_accessibility_manager_win.cc
index d4dbe6d..4e5f8dc 100644
--- a/content/browser/accessibility/browser_accessibility_manager_win.cc
+++ b/content/browser/accessibility/browser_accessibility_manager_win.cc
@@ -64,9 +64,14 @@ class AccessibleHWND
 
   IAccessible* window_accessible() { return window_accessible_; }
 
+  void OnManagerDeleted() {
+    manager_ = NULL;
+  }
+
  protected:
   virtual void OnFinalMessage(HWND hwnd) OVERRIDE {
-    manager_->OnAccessibleHwndDeleted();
+    if (manager_)
+      manager_->OnAccessibleHwndDeleted();
     delete this;
   }
 
@@ -74,7 +79,7 @@ class AccessibleHWND
   LRESULT OnGetObject(UINT message,
                       WPARAM w_param,
                       LPARAM l_param) {
-    if (OBJID_CLIENT != l_param)
+    if (OBJID_CLIENT != l_param || !manager_)
       return static_cast<LRESULT>(0L);
 
     base::win::ScopedComPtr<IAccessible> root(
@@ -124,6 +129,8 @@ BrowserAccessibilityManagerWin::~BrowserAccessibilityManagerWin() {
     tracked_scroll_object_->Release();
     tracked_scroll_object_ = NULL;
   }
+  if (accessible_hwnd_)
+    accessible_hwnd_->OnManagerDeleted();
 }
 
 // static
@@ -305,7 +312,14 @@ BrowserAccessibilityWin* BrowserAccessibilityManagerWin::GetFromUniqueIdWin(
 }
 
 void BrowserAccessibilityManagerWin::OnAccessibleHwndDeleted() {
+  // If the AccessibleHWND is deleted, |parent_hwnd_| and
+  // |parent_iaccessible_| are no longer valid either, since they were
+  // derived from AccessibleHWND. We don't have to restore them to
+  // previous values, though, because this should only happen
+  // during the destruct sequence for this window.
   accessible_hwnd_ = NULL;
+  parent_hwnd_ = NULL;
+  parent_iaccessible_ = NULL;
 }
 
 }  // namespace content