Bug 398021. Crash [@ nsAccessible::GetFinalRole] with moving options and using visibility: hidden. r=surkov, a=schrep

accessible/src/base/nsDocAccessible.cpp

@@ -1806,6 +1806,10 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
     // event for it
     GetAccService()->GetAttachedAccessibleFor(childNode,
                                               getter_AddRefs(childAccessible));
+    if (childAccessible) {
+      // New accessible created -- to make sure to adopt the children from the old parent.
+      AdoptChildren(childAccessible);
+    }
   }
 
 #ifdef DEBUG_A11Y
@@ -1933,6 +1937,13 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
   return NS_OK;
 }
 
+void nsDocAccessible::AdoptChildren(nsIAccessible *aAccessible)
+{
+  PRInt32 childCountUnused;
+  // Force CacheChildren()
+  aAccessible->GetChildCount(&childCountUnused);
+}
+
 NS_IMETHODIMP
 nsDocAccessible::GetAccessibleInParentChain(nsIDOMNode *aNode,
                                             PRBool aCanCreate,
@@ -1959,14 +1970,17 @@ nsDocAccessible::GetAccessibleInParentChain(nsIDOMNode *aNode,
     if (NS_SUCCEEDED(accService->GetRelevantContentNodeFor(currentNode, getter_AddRefs(relevantNode))) && relevantNode) {
       currentNode = relevantNode;
     }
-    if (aCanCreate) {
-      accService->GetAccessibleInWeakShell(currentNode, mWeakShell, aAccessible);
+    // Try cached accessible
+    nsCOMPtr<nsIAccessNode> accessNode;
+    GetCachedAccessNode(currentNode, getter_AddRefs(accessNode)); // AddRefs
+    if (accessNode) {
+      CallQueryInterface(accessNode, aAccessible); // AddRefs
     }
-    else { // Only return cached accessibles, don't create anything
-      nsCOMPtr<nsIAccessNode> accessNode;
-      GetCachedAccessNode(currentNode, getter_AddRefs(accessNode)); // AddRefs
-      if (accessNode) {
-        CallQueryInterface(accessNode, aAccessible); // AddRefs
+    if (!*aAccessible && aCanCreate) {
+      accService->GetAccessibleInWeakShell(currentNode, mWeakShell, aAccessible);
+      if (*aAccessible) {
+        // New accessible created -- to make sure to adopt the children from the old parent.
+        AdoptChildren(*aAccessible);
       }
     }
   } while (!*aAccessible);

accessible/src/base/nsDocAccessible.h

@@ -204,6 +204,14 @@ class nsDocAccessible : public nsHyperTextAccessibleWrap,
     nsresult FireShowHideEvents(nsIDOMNode *aDOMNode, PRUint32 aEventType,
                                 PRBool aDelay, PRBool aForceIsFromUserInput);
 
+    /**
+     * For a new accessible that is created because of a DOM mutation,
+     * make sure that any children it has, which were already children
+     * of the parent should be assigned to it
+     * @param aAccessible The new accessible
+     */
+    void AdoptChildren(nsIAccessible *aAccessible);
+
     nsAccessNodeHashtable mAccessNodeCache;
     void *mWnd;
     nsCOMPtr<nsIDocument> mDocument;