Bug 675861 - Crash [@ AccIterator::GetNext()], r=tbsaunde
authorAlexander Surkov <surkov.alexander@gmail.com>
Fri, 05 Aug 2011 17:10:41 +0900
changeset 73900 fff506a4889bb5df486975758acc5373dc32b86c
parent 73899 6181622382cfe47637cac70bff1a09e80b6cc2cb
child 73901 c7931e07dd4dcda4916d58753bfdb933372e8148
push id2
push userbsmedberg@mozilla.com
push dateFri, 19 Aug 2011 14:38:13 +0000
reviewerstbsaunde
bugs675861
milestone8.0a1
Bug 675861 - Crash [@ AccIterator::GetNext()], r=tbsaunde
accessible/src/base/nsARIAGridAccessible.cpp
accessible/tests/mochitest/table.js
accessible/tests/mochitest/table/test_struct_ariagrid.html
--- a/accessible/src/base/nsARIAGridAccessible.cpp
+++ b/accessible/src/base/nsARIAGridAccessible.cpp
@@ -101,17 +101,19 @@ nsARIAGridAccessible::GetColumnCount(PRI
 {
   NS_ENSURE_ARG_POINTER(acolumnCount);
   *acolumnCount = 0;
 
   if (IsDefunct())
     return NS_ERROR_FAILURE;
 
   AccIterator rowIter(this, filters::GetRow);
-  nsAccessible *row = rowIter.GetNext();
+  nsAccessible* row = rowIter.GetNext();
+  if (!row)
+    return NS_OK;
 
   AccIterator cellIter(row, filters::GetCell);
   nsAccessible *cell = nsnull;
 
   while ((cell = cellIter.GetNext()))
     (*acolumnCount)++;
 
   return NS_OK;
--- a/accessible/tests/mochitest/table.js
+++ b/accessible/tests/mochitest/table.js
@@ -43,17 +43,17 @@ function testTableStruct(aIdentifier, aC
                          aCaption, aSummary, aIsTreeTable)
 {
   var tableNode = getNode(aIdentifier);
   var isGrid = tableNode.getAttribute("role") == "grid" ||
     tableNode.getAttribute("role") == "treegrid" ||
     tableNode.localName == "tree";
 
   var rowCount = aCellsArray.length;
-  var colsCount = aCellsArray[0].length;
+  var colsCount = aCellsArray[0] ? aCellsArray[0].length : 0;
 
   // Test table accessible tree.
   var tableObj = {
     role: aIsTreeTable ? ROLE_TREE_TABLE : ROLE_TABLE,
     children: []
   };
 
   // caption accessible handling
--- a/accessible/tests/mochitest/table/test_struct_ariagrid.html
+++ b/accessible/tests/mochitest/table/test_struct_ariagrid.html
@@ -45,16 +45,24 @@
       // ARIA grid with HTML table elements
       cellsArray = [
         [kColHeaderCell, kColHeaderCell],
         [kDataCell,      kDataCell]
       ];
 
       testTableStruct("grid2", cellsArray);
 
+      //////////////////////////////////////////////////////////////////////////
+      // ARIA grid of wrong markup
+      cellsArray = [ ];
+      testTableStruct("grid3", cellsArray);
+
+      cellsArray = [ [] ];
+      testTableStruct("grid4", cellsArray);
+
       SimpleTest.finish();
     }
 
     SimpleTest.waitForExplicitFinish();
     addA11yLoadEvent(doTest);
   </script>
 </head>
 
@@ -63,16 +71,19 @@
      title="ARIA grid based on HTML table"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=491683">Mozilla Bug 491683</a>
   <a target="_blank"
      title="implement IAccessibleTable2"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=512424">Mozilla Bug 512424</a>
   <a target="_blank"
      title="nsHTMLTableCellAccessible is used in dojo's crazy ARIA grid"
      href="https://bugzilla.mozilla.org/show_bug.cgi?id=513848">Mozilla Bug 513848</a>
+  <a target="_blank"
+     title="Crash [@ AccIterator::GetNext()]"
+     href="https://bugzilla.mozilla.org/show_bug.cgi?id=675861">Mozilla Bug 675861</a>
 
   <p id="display"></p>
   <div id="content" style="display: none"></div>
   <pre id="test">
   </pre>
 
   <!-- Not usual markup to avoid text accessible between cell accessibles -->
   <div id="table" role="grid">
@@ -128,10 +139,13 @@
         <tr>
           <td role="gridcell">cell1</td>
           <td role="gridcell" tabindex="-1">cell2</td>
         </tr>
       </table>
     </div>
   </div>
 
+  <!-- Wrong markup ARIA grid -->
+  <div role="grid" id="grid3"></div>
+  <div role="grid" id="grid4"><div role="row"></div></div>
 </body>
 </html>