Bug 306750. Fix crashes in accessibility core based on talkback reports. r=parente, sr=bryner

accessible/src/base/nsRootAccessible.cpp

@@ -399,6 +399,9 @@ void nsRootAccessible::TryFireEarlyLoadEvent(nsIAccessible *aAccessible, nsIDOMN
       GetDocAccessibleFor(rootContentTreeItem);
     nsCOMPtr<nsIAccessible> rootContentAccessible =
       do_QueryInterface(rootContentDocAccessible);
+    if (!rootContentAccessible) {
+      return;
+    }
     PRUint32 state;
     rootContentAccessible->GetFinalState(&state);
     if (state & STATE_BUSY) {

accessible/src/html/nsHTMLFormControlAccessible.cpp

@@ -170,10 +170,11 @@ NS_IMETHODIMP nsHTMLButtonAccessible::DoAction(PRUint8 index)
 
 NS_IMETHODIMP nsHTMLButtonAccessible::GetState(PRUint32 *_retval)
 {
-  nsFormControlAccessible::GetState(_retval);
   nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
-  NS_ASSERTION(element, "No nsIDOMElement for button node!");
+  if (!element) {
-
+    return NS_ERROR_FAILURE;  // Button accessible shut down
+  }
+  nsFormControlAccessible::GetState(_retval);
   nsAutoString buttonType;
   element->GetAttribute(NS_LITERAL_STRING("type"), buttonType);
   if (buttonType.LowerCaseEqualsLiteral("submit"))
@@ -274,12 +275,13 @@ NS_IMETHODIMP nsHTML4ButtonAccessible::GetRole(PRUint32 *_retval)
 
 NS_IMETHODIMP nsHTML4ButtonAccessible::GetState(PRUint32 *_retval)
 {
+  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
+  if (!element) {
+    return NS_ERROR_FAILURE;  // Button accessible shut down
+  }
   nsAccessible::GetState(_retval);
   *_retval |= STATE_FOCUSABLE;
 
-  nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
-  NS_ASSERTION(element, "No nsIDOMElement for button node!");
-
   nsAutoString buttonType;
   element->GetAttribute(NS_LITERAL_STRING("type"), buttonType);
   if (buttonType.LowerCaseEqualsLiteral("submit"))

accessible/src/html/nsHTMLSelectAccessible.cpp

@@ -460,13 +460,6 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessible::GetRole(PRUint32 *aRole)
   return NS_OK;
 }
 
-/** Return our cached parent */
-NS_IMETHODIMP nsHTMLSelectOptionAccessible::GetParent(nsIAccessible **aParent)
-{   
-  NS_IF_ADDREF(*aParent = mParent);
-  return NS_OK;
-}
-
 /**
   * Get our Name from our Content's subtree
   */
@@ -602,7 +595,9 @@ NS_IMETHODIMP nsHTMLSelectOptionAccessible::DoAction(PRUint8 index)
       return NS_ERROR_FAILURE;
     // Clear old selection
     nsCOMPtr<nsIDOMNode> oldHTMLOptionNode, selectNode;
-    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(mParent));
+    nsCOMPtr<nsIAccessible> parent;
+    GetParent(getter_AddRefs(parent));
+    nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(parent));
     NS_ASSERTION(accessNode, "Unable to QI to nsIAccessNode");
     accessNode->GetDOMNode(getter_AddRefs(selectNode));
     GetFocusedOptionNode(selectNode, getter_AddRefs(oldHTMLOptionNode));

accessible/src/html/nsHTMLSelectAccessible.h

@@ -157,7 +157,6 @@ public:
   NS_IMETHOD GetNumActions(PRUint8 *_retval);
   NS_IMETHOD GetState(PRUint32 *_retval);
   NS_IMETHOD GetRole(PRUint32 *aRole);
-  NS_IMETHOD GetParent(nsIAccessible **aParent);
   NS_IMETHOD GetName(nsAString& aName);
   nsIFrame*  GetBoundsFrame();
   static nsresult GetFocusedOptionNode(nsIDOMNode *aListNode, nsIDOMNode **aFocusedOptionNode);

accessible/src/msaa/nsAccessibleWrap.cpp

@@ -909,6 +909,8 @@ nsAccessibleWrap::Next(ULONG aNumElementsRequested, VARIANT FAR* pvar, ULONG FAR
     PRBool wasAccessibleFetched = PR_FALSE;
     nsAccessibleWrap *msaaAccessible = 
       NS_STATIC_CAST(nsAccessibleWrap*, pvar[*aNumElementsFetched].pdispVal);
+    if (!msaaAccessible)
+      break;
     if (childIndex >= mEnumVARIANTPosition) {
       if (++*aNumElementsFetched >= aNumElementsRequested)
         break;
@@ -1003,7 +1005,7 @@ STDMETHODIMP nsAccessibleWrap::Invoke(DISPID dispIdMember, REFIID riid,
 NS_IMETHODIMP nsAccessibleWrap::GetNativeInterface(void **aOutAccessible)
 {
   *aOutAccessible = NS_STATIC_CAST(IAccessible*, this);
-  NS_STATIC_CAST(IAccessible*, this)->AddRef();
+  NS_ADDREF_THIS();
   return NS_OK;
 }
 

accessible/src/msaa/nsDocAccessibleWrap.cpp

@@ -239,6 +239,9 @@ NS_IMETHODIMP nsDocAccessibleWrap::FireToolkitEvent(PRUint32 aEvent, nsIAccessib
   }
   else {
     childID = GetChildIDFor(aAccessible); // get the id for the accessible
+    if (!childID) {
+      return NS_OK; // Can't fire an event without a child ID
+    }
     if (aAccessible != this) {
       // See if we're in a scrollable area with its own window
       nsCOMPtr<nsIAccessible> accessible;
@@ -278,6 +281,9 @@ PRInt32 nsDocAccessibleWrap::GetChildIDFor(nsIAccessible* aAccessible)
 
   void *uniqueID;
   nsCOMPtr<nsIAccessNode> accessNode(do_QueryInterface(aAccessible));
+  if (!accessNode) {
+    return 0;
+  }
   accessNode->GetUniqueID(&uniqueID);
 
   // Yes, this means we're only compatibible with 32 bit

accessible/src/xul/nsXULMenuAccessible.cpp

@@ -98,9 +98,11 @@ NS_IMETHODIMP nsXULMenuitemAccessible::GetState(PRUint32 *_retval)
   nsCOMPtr<nsIAccessible> parentAccessible;
   if (parentAccessible) {
     GetParent(getter_AddRefs(parentAccessible));
-    parentAccessible->GetFinalState(&parentState);
+    if (parentAccessible) {
-    *_retval &= ~STATE_OFFSCREEN;  // clear the old OFFSCREEN bit
+      parentAccessible->GetFinalState(&parentState);
-    *_retval |= (parentState & STATE_OFFSCREEN);  // or it with the parent's offscreen bit
+      *_retval &= ~STATE_OFFSCREEN;  // clear the old OFFSCREEN bit
+      *_retval |= (parentState & STATE_OFFSCREEN);  // or it with the parent's offscreen bit
+    }
   }
 
   return NS_OK;