Bug 409473. New crash caused by bug 405248. r+sr=roc, a=blocking1.9
authoraaronleventhal@moonset.net
Mon, 14 Jan 2008 06:34:40 -0800
changeset 10256 c7e0729465f69538d21bdea30b7fc179b91cb85c
parent 10255 372d37c242bbcacd26a0555ec692dfcbd2320fe3
child 10257 2630a67dc51be324ca2efb83198f4ce85caa208a
push idunknown
push userunknown
push dateunknown
reviewersblocking1.9
bugs409473, 405248
milestone1.9b3pre
Bug 409473. New crash caused by bug 405248. r+sr=roc, a=blocking1.9
layout/generic/nsBRFrame.cpp
--- a/layout/generic/nsBRFrame.cpp
+++ b/layout/generic/nsBRFrame.cpp
@@ -268,16 +268,21 @@ BRFrame::PeekOffsetWord(PRBool aForward,
   NS_ASSERTION (aOffset && *aOffset <= 1, "aOffset out of range");
   // Keep going. The actual line jumping will stop us.
   return PR_FALSE;
 }
 
 #ifdef ACCESSIBILITY
 NS_IMETHODIMP BRFrame::GetAccessible(nsIAccessible** aAccessible)
 {
+  NS_ENSURE_TRUE(mContent, NS_ERROR_FAILURE);
   nsCOMPtr<nsIAccessibilityService> accService = do_GetService("@mozilla.org/accessibilityService;1");
-  if (accService) {
-    return accService->CreateHTMLBRAccessible(static_cast<nsIFrame*>(this), aAccessible);
+  NS_ENSURE_TRUE(accService, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIContent> parent = mContent->GetBindingParent();
+  if (parent && parent->IsNativeAnonymous() && parent->GetChildCount() == 1) {
+    // This <br> is the only node in a text control, therefore it is the hacky
+    // "bogus node" used when there is no text in the control
+    return NS_ERROR_FAILURE;
   }
-  return NS_ERROR_FAILURE;
+  return accService->CreateHTMLBRAccessible(static_cast<nsIFrame*>(this), aAccessible);
 }
 #endif