Bug 413143. Crash in RefreshNodes() for QueryElementAt(). r=marcoz, a=dsicore

accessible/src/base/nsAccessible.cpp

@@ -711,6 +711,7 @@ NS_IMETHODIMP nsAccessible::GetChildAt(PRInt32 aChildNum, nsIAccessible **aChild
 // readonly attribute nsIArray children;
 NS_IMETHODIMP nsAccessible::GetChildren(nsIArray **aOutChildren)
 {
+  *aOutChildren = nsnull;
   nsCOMPtr<nsIMutableArray> children = do_CreateInstance(NS_ARRAY_CONTRACTID);
   if (!children)
     return NS_ERROR_FAILURE;

accessible/src/base/nsDocAccessible.cpp

@@ -1660,9 +1660,9 @@ void nsDocAccessible::RefreshNodes(nsIDOMNode *aStartNode)
       // GetNextSibling(), because after we shutdown the first child,
       // mNextSibling will be set null.
       accessible->GetChildren(getter_AddRefs(children));
-
-      PRUint32 childCount;
-      children->GetLength(&childCount);
+      PRUint32 childCount =0;
+      if (children)
+        children->GetLength(&childCount);
       nsCOMPtr<nsIDOMNode> possibleAnonNode;
       for (PRUint32 index = 0; index < childCount; index++) {
         nsCOMPtr<nsIAccessNode> childAccessNode;