Bug 626841 - Firefox 4.0b10pre crash in [@ nsAccessible::Role() ], r=davidb, a=blockingBetaN+
authorAlexander Surkov <surkov.alexander@gmail.com>
Thu, 20 Jan 2011 00:01:31 +0800
changeset 60867 94271581b60114a40f4e08f4d198a53e2fdb64d7
parent 60866 37e85354ebaf6a8ac8fcac137222d85dfd5391bc
child 60868 b22bb39e834f96e2369eae90031fbe5dd69d7f4a
push idunknown
push userunknown
push dateunknown
reviewersdavidb, blockingBetaN
bugs626841
milestone2.0b10pre
Bug 626841 - Firefox 4.0b10pre crash in [@ nsAccessible::Role() ], r=davidb, a=blockingBetaN+
accessible/src/base/nsDocAccessible.cpp
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -1846,30 +1846,33 @@ nsDocAccessible::ProcessContentInserted(
 
   // XXX: Invalidate parent-child relations for container accessible and its
   // children because there's no good way to find insertion point of new child
   // accessibles into accessible tree. We need to invalidate children even
   // there's no inserted accessibles in the end because accessible children
   // are created while parent recaches child accessibles.
   aContainer->InvalidateChildren();
 
-  nsAccessible* directContainer =
-    GetAccService()->GetContainerAccessible(aInsertedContent->ElementAt(0),
-                                            mWeakShell);
-
   // The container might be changed, for example, because of the subsequent
   // overlapping content insertion (i.e. other content was inserted between this
   // inserted content and its container or the content was reinserted into
   // different container of unrelated part of tree). These cases result in
   // double processing, however generated events are coalesced and we don't
   // harm an AT. On the another hand container can be different because direct
   // container wasn't cached yet when we handled content insertion notification
   // and therefore we can't ignore the case when container has been changed.
-  for (PRUint32 idx = 0; idx < aInsertedContent->Length(); idx++)
-    UpdateTree(directContainer, aInsertedContent->ElementAt(idx), PR_TRUE);
+  // Theoretically the element might be not in tree at all at this point what
+  // means there's no container.
+  for (PRUint32 idx = 0; idx < aInsertedContent->Length(); idx++) {
+    nsAccessible* directContainer =
+      GetAccService()->GetContainerAccessible(aInsertedContent->ElementAt(idx),
+                                              mWeakShell);
+    if (directContainer)
+      UpdateTree(directContainer, aInsertedContent->ElementAt(idx), PR_TRUE);
+  }
 }
 
 void
 nsDocAccessible::UpdateTree(nsAccessible* aContainer, nsIContent* aChildNode,
                             PRBool aIsInsert)
 {
   PRUint32 updateFlags =
     UpdateTreeInternal(aContainer, aChildNode, aChildNode->GetNextSibling(),