From f9fbfefda3b2eebf35d1cf0f12611e8b7cce2079 Mon Sep 17 00:00:00 2001
From: Eitan Isaacson <eitan@monotonous.org>
Date: Tue, 29 Nov 2022 20:31:21 +0000
Subject: [PATCH] Bug 1801986 - Set pivot root to top remote document. r=Jamie

The pivot should never cross from remote into parent process local
containers. We need to explicitly set the root for the pivot, and
assert for this in the pivot traversal methods.

Differential Revision: https://phabricator.services.mozilla.com/D163285
---
 accessible/android/AccessibleWrap.cpp | 13 ++++++++++++-
 accessible/base/Pivot.cpp             | 11 +++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/accessible/android/AccessibleWrap.cpp b/accessible/android/AccessibleWrap.cpp
index 20b104992329..50fe4a9792fc 100644
--- a/accessible/android/AccessibleWrap.cpp
+++ b/accessible/android/AccessibleWrap.cpp
@@ -265,7 +265,18 @@ bool AccessibleWrap::DoAction(uint8_t aIndex) const {
 Accessible* AccessibleWrap::DoPivot(Accessible* aAccessible,
                                     int32_t aGranularity, bool aForward,
                                     bool aInclusive) {
-  a11y::Pivot pivot(nullptr);
+  Accessible* pivotRoot = nullptr;
+  if (aAccessible->IsRemote()) {
+    // If this is a remote accessible provide the top level
+    // remote doc as the pivot root for thread safety reasons.
+    DocAccessibleParent* doc = aAccessible->AsRemote()->Document();
+    while (doc && !doc->IsTopLevel()) {
+      doc = doc->ParentDoc();
+    }
+    MOZ_ASSERT(doc, "Failed to get top level DocAccessibleParent");
+    pivotRoot = doc;
+  }
+  a11y::Pivot pivot(pivotRoot);
   // Depending on the start accessible, the pivot rule will either traverse
   // local or remote accessibles exclusively.
   TraversalRule rule(aGranularity, aAccessible->IsLocal());
diff --git a/accessible/base/Pivot.cpp b/accessible/base/Pivot.cpp
index bb521be941b6..8c5500f6b732 100644
--- a/accessible/base/Pivot.cpp
+++ b/accessible/base/Pivot.cpp
@@ -65,6 +65,11 @@ Accessible* Pivot::SearchBackward(Accessible* aAnchor, PivotRule& aRule,
 
   while (acc && acc != mRoot) {
     Accessible* parent = acc->Parent();
+#if defined(ANDROID)
+    MOZ_ASSERT(
+        acc->IsLocal() || (acc->IsRemote() && parent->IsRemote()),
+        "Pivot::SearchBackward climbed out of remote subtree in Android!");
+#endif
     int32_t idxInParent = acc->IndexInParent();
     while (idxInParent > 0 && parent) {
       acc = parent->ChildAt(--idxInParent);
@@ -141,6 +146,12 @@ Accessible* Pivot::SearchForward(Accessible* aAnchor, PivotRule& aRule,
         break;
       }
       temp = temp->Parent();
+#if defined(ANDROID)
+      MOZ_ASSERT(
+          acc->IsLocal() || (acc->IsRemote() && temp->IsRemote()),
+          "Pivot::SearchForward climbed out of remote subtree in Android!");
+#endif
+
     } while (temp);
 
     if (!sibling) {