Bug 1296942 - AccessibleWrap::GetXPAccessibleFor() should check there is a child at an index before returning it. r=davidb, a=abillings
authorTrevor Saunders <tbsaunde@tbsaunde.org>
Mon, 22 Aug 2016 13:40:24 -0400
changeset 347942 5ef82dde6a86dcc38c37cfacc9a6c71104aa55ed
parent 347941 524e793f63aa37fc7f8f911cfc3de8018fb4f311
child 347943 ca23401297492d3ccc01f237158c22582aed9f66
push id6389
push userraliiev@mozilla.com
push dateMon, 19 Sep 2016 13:38:22 +0000
treeherdermozilla-beta@01d67bfe6c81 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersdavidb, abillings
bugs1296942
milestone50.0a2
Bug 1296942 - AccessibleWrap::GetXPAccessibleFor() should check there is a child at an index before returning it. r=davidb, a=abillings
accessible/windows/msaa/AccessibleWrap.cpp
--- a/accessible/windows/msaa/AccessibleWrap.cpp
+++ b/accessible/windows/msaa/AccessibleWrap.cpp
@@ -1507,16 +1507,20 @@ AccessibleWrap::GetXPAccessibleFor(const
 
   if (IsProxy() ? Proxy()->MustPruneChildren() : nsAccUtils::MustPrune(this)) {
     return nullptr;
   }
 
   if (aVarChild.lVal > 0) {
     // Gecko child indices are 0-based in contrast to indices used in MSAA.
     if (IsProxy()) {
+      if (static_cast<uint32_t>(aVarChild.lVal) > Proxy()->ChildrenCount()) {
+        return nullptr;
+      }
+
       return WrapperFor(Proxy()->ChildAt(aVarChild.lVal - 1));
     } else {
       return GetChildAt(aVarChild.lVal - 1);
     }
   }
 
   // If lVal negative then it is treated as child ID and we should look for
   // accessible through whole accessible subtree including subdocuments.