Bug 1319640: Ensure that a11y::ChildrenEnumVariant does not output bad native accessible pointers; r=tbsaunde, a=gchang
authorAaron Klotz <aklotz@mozilla.com>
Sat, 03 Dec 2016 15:42:21 -0700
changeset 452609 5e4495f87ea2d1f0e3a3d33e3fd4c82c2fb6dd8d
parent 452608 b44bdfc5b686395e16bd760ccbf15e1d9093f19a
child 452610 ffbf2dcc32bbbb54b2dde926f2feca070f330a49
push id39418
push userbmo:twointofive@gmail.com
push dateWed, 21 Dec 2016 20:59:30 +0000
reviewerstbsaunde, gchang
bugs1319640
milestone51.0
Bug 1319640: Ensure that a11y::ChildrenEnumVariant does not output bad native accessible pointers; r=tbsaunde, a=gchang MozReview-Commit-ID: l0RDW9zDOo
accessible/windows/msaa/EnumVariant.cpp
--- a/accessible/windows/msaa/EnumVariant.cpp
+++ b/accessible/windows/msaa/EnumVariant.cpp
@@ -29,23 +29,34 @@ ChildrenEnumVariant::Next(ULONG aCount, 
     return E_INVALIDARG;
 
   *aCountFetched = 0;
 
   if (mAnchorAcc->IsDefunct() || mAnchorAcc->GetChildAt(mCurIndex) != mCurAcc)
     return CO_E_OBJNOTCONNECTED;
 
   ULONG countFetched = 0;
-  for (; mCurAcc && countFetched < aCount; countFetched++) {
+  while (mCurAcc && countFetched < aCount) {
     VariantInit(aItems + countFetched);
-    aItems[countFetched].pdispVal = AccessibleWrap::NativeAccessible(mCurAcc);
+
+    IDispatch* accNative = AccessibleWrap::NativeAccessible(mCurAcc);
+
+    ++mCurIndex;
+    mCurAcc = mAnchorAcc->GetChildAt(mCurIndex);
+
+    // Don't output the accessible and count it as having been fetched unless
+    // it is non-null
+    MOZ_ASSERT(accNative);
+    if (!accNative) {
+      continue;
+    }
+
+    aItems[countFetched].pdispVal = accNative;
     aItems[countFetched].vt = VT_DISPATCH;
-
-    mCurIndex++;
-    mCurAcc = mAnchorAcc->GetChildAt(mCurIndex);
+    ++countFetched;
   }
 
   (*aCountFetched) = countFetched;
 
   return countFetched < aCount ? S_FALSE : S_OK;
 
   A11Y_TRYBLOCK_END
 }