Bug 1582561 - Don't access lazily created descendants in GetAccessibleOrDescendant. r=Jamie

Lazily creating children might cause us to make layout calls at unsafe times.

Differential Revision: https://phabricator.services.mozilla.com/D47361

--HG--
extra : moz-landing-system : lando

accessible/generic/DocAccessible.cpp

@@ -1222,9 +1222,12 @@ Accessible* DocAccessible::GetAccessibleOrDescendant(nsINode* aNode) const {
   }
 
   if (acc) {
-    uint32_t childCnt = acc->ChildCount();
+    // We access the `mChildren` array directly so that we don't access
+    // lazily created children in places like `XULTreeAccessible` and
+    // `XULTreeGridAccessible`.
+    uint32_t childCnt = acc->mChildren.Length();
     for (uint32_t idx = 0; idx < childCnt; idx++) {
-      Accessible* child = acc->GetChildAt(idx);
+      Accessible* child = acc->mChildren.ElementAt(idx);
       for (nsIContent* elm = child->GetContent();
            elm && elm != acc->GetContent();
            elm = elm->GetFlattenedTreeParent()) {