Bug 337148. Crash in accessibility when huge file loaded with with Window-Eyes screen reader. r=ginn.chen, sr=darin, a=ginn.chen

accessible/src/base/nsAccessNode.cpp

@@ -84,8 +84,7 @@ nsInterfaceHashtable<nsVoidHashKey, nsIAccessNode> nsAccessNode::gGlobalDocAcces
 NS_IMPL_ISUPPORTS2(nsAccessNode, nsIAccessNode, nsPIAccessNode)
 
 nsAccessNode::nsAccessNode(nsIDOMNode *aNode, nsIWeakReference* aShell): 
-  mDOMNode(aNode), mWeakShell(aShell), mRefCnt(0),
-  mAccChildCount(eChildCountUninitialized)
+  mDOMNode(aNode), mWeakShell(aShell), mRefCnt(0)
 {
 #ifdef DEBUG
   mIsInitialized = PR_FALSE;

accessible/src/base/nsAccessNode.h

@@ -59,8 +59,6 @@ class nsIFrame;
 class nsIDOMNodeList;
 class nsITimer;
 
-enum { eChildCountUninitialized = 0xffff };
-
 #define ACCESSIBLE_BUNDLE_URL "chrome://global-platform/locale/accessible.properties"
 #define PLATFORM_KEYS_BUNDLE_URL "chrome://global-platform/locale/platformKeys.properties"
 
@@ -133,8 +131,7 @@ protected:
     nsCOMPtr<nsIDOMNode> mDOMNode;
     nsCOMPtr<nsIWeakReference> mWeakShell;
 
-    PRInt16 mRefCnt;
-    PRUint16 mAccChildCount;
+    PRInt32 mRefCnt;
     NS_DECL_OWNINGTHREAD
 
 #ifdef DEBUG

accessible/src/base/nsAccessible.cpp

@@ -152,7 +152,8 @@ nsresult nsAccessible::QueryInterface(REFNSIID aIID, void** aInstancePtr)
 }
 
 nsAccessible::nsAccessible(nsIDOMNode* aNode, nsIWeakReference* aShell): nsAccessNodeWrap(aNode, aShell), 
-  mParent(nsnull), mFirstChild(nsnull), mNextSibling(nsnull), mRoleMapEntry(nsnull)
+  mParent(nsnull), mFirstChild(nsnull), mNextSibling(nsnull), mRoleMapEntry(nsnull),
+  mAccChildCount(eChildCountUninitialized)
 {
 #ifdef NS_DEBUG_X
    {

accessible/src/base/nsAccessible.h

@@ -59,6 +59,10 @@ class nsIAtom;
 // When mNextSibling is set to this, it indicates there ar eno more siblings
 #define DEAD_END_ACCESSIBLE NS_STATIC_CAST(nsIAccessible*, (void*)1)
 
+// Saves a data member -- if child count equals this value we haven't
+// cached children or child count yet
+enum { eChildCountUninitialized = 0xffffffff };
+
 struct nsStateMapEntry
 {
   const char* attributeName;  // magic value of nsnull means last entry in map
@@ -190,6 +194,7 @@ protected:
   nsCOMPtr<nsIAccessible> mParent;
   nsIAccessible *mFirstChild, *mNextSibling;
   nsRoleMapEntry *mRoleMapEntry; // Non-null indicates author-supplied role; possibly state & value as well
+  PRUint32 mAccChildCount;
 
   static nsRoleMapEntry gWAIRoleMap[];
   static nsStateMapEntry gDisabledStateMap;