bug 417500. Crash [ @ CAccessibleText::get_attributes ]. r=surkov, a=beltzner

accessible/src/msaa/CAccessibleText.cpp

@@ -113,12 +113,12 @@ __try {
   if (!winAccessNode)
     return E_FAIL;
 
-  void **instancePtr = 0;
-  winAccessNode->QueryNativeInterface(IID_IAccessible2, instancePtr);
+  void *instancePtr = 0;
+  winAccessNode->QueryNativeInterface(IID_IAccessible2, &instancePtr);
   if (!instancePtr)
     return E_FAIL;
 
-  IAccessible2 *pAccessible2 = static_cast<IAccessible2*>(*instancePtr);
+  IAccessible2 *pAccessible2 = static_cast<IAccessible2*>(instancePtr);
   HRESULT hr = pAccessible2->get_attributes(aTextAttributes);
   pAccessible2->Release();
 

accessible/src/msaa/nsAccessibleWrap.cpp

@@ -1474,7 +1474,7 @@ __try {
     return E_FAIL;
 
   if (!attributes)
-    return S_OK;
+    return S_FALSE;
 
   nsCOMPtr<nsISimpleEnumerator> propEnum;
   attributes->Enumerate(getter_AddRefs(propEnum));