Bug 348007 Firefox will crash if use index = -1 to get top level

accessible
r= aaronleventhal

accessible/src/atk/nsAccessibleWrap.cpp

@@ -850,6 +850,11 @@ getChildCountCB(AtkObject *aAtkObj)
 AtkObject *
 refChildCB(AtkObject *aAtkObj, gint aChildIndex)
 {
+    // aChildIndex should not be less than zero
+    if (aChildIndex < 0) {
+      return nsnull;
+    }
+
     // XXX Fix this so it is not O(n^2) to walk through the children!
     // Either we can cache the last accessed child so that we can just GetNextSibling()
     // or we should cache an array of children in each nsAccessible

accessible/src/atk/nsAppRootAccessible.cpp

@@ -626,6 +626,8 @@ NS_IMETHODIMP nsAppRootAccessible::GetChildAt(PRInt32 aChildNum,
     NS_ENSURE_SUCCESS(rv, rv);
     if (aChildNum >= NS_STATIC_CAST(PRInt32, count))
         return NS_ERROR_INVALID_ARG;
+    if (aChildNum < 0)
+        return NS_ERROR_INVALID_ARG;
 
     nsCOMPtr<nsIWeakReference> childWeakRef;
     rv = mChildren->QueryElementAt(aChildNum, NS_GET_IID(nsIWeakReference),