Bug 1336971: Ensure that we always re-examine the length of the top-level remote doc array to pick up any changes due to mutation; r=Jamie

MozReview-Commit-ID: BLq1zzyKs9e

accessible/windows/msaa/AccessibleWrap.cpp

@@ -1554,8 +1554,10 @@ AccessibleWrap::GetRemoteIAccessibleFor(const VARIANT& aVarChild)
 
   RefPtr<IAccessible> result;
 
-  size_t docCount = remoteDocs->Length();
-  for (size_t i = 0; i < docCount; i++) {
+  // We intentionally leave the call to remoteDocs->Length() inside the loop
+  // condition because it is possible for reentry to occur in the call to
+  // GetProxiedAccessibleInSubtree() such that remoteDocs->Length() is mutated.
+  for (size_t i = 0; i < remoteDocs->Length(); i++) {
     DocAccessibleParent* remoteDoc = remoteDocs->ElementAt(i);
 
     uint32_t remoteDocMsaaId = WrapperFor(remoteDoc)->GetExistingID();