diff --git a/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp b/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp
index f1a0c2e995e..f2a9770c375 100755
--- a/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp
+++ b/mozilla/accessible/src/base/nsAccessibleTreeWalker.cpp
@@ -230,6 +230,7 @@ void nsAccessibleTreeWalker::UpdateFrame(PRBool aTryFirstChild)
     return;
   }
   if (aTryFirstChild) {
+    nsIContent *containerContent = mState.frame->GetContent();
     mState.frame = mState.frame->GetFirstChild(nsnull);
 // temporary workaround for Bug 359210. We never want to walk frames.
 // Aaron Leventhal will refix :before and :after content later without walking frames.
@@ -253,6 +254,17 @@ void nsAccessibleTreeWalker::UpdateFrame(PRBool aTryFirstChild)
       mState.siblingIndex = eSiblingsWalkFrames;
     }
 #endif
+    // Special case: <input type="file">
+    // We should still need to walk frames inside the file control frame
+    // This special case may turn into a more general rule after Firefox 3,
+    // if HTML 5 controls use nsIAnonymousContentCreator
+    if (containerContent->Tag() == nsAccessibilityAtoms::input &&
+        containerContent->AttrValueIs(kNameSpaceID_None, nsAccessibilityAtoms::type,
+                                      NS_LITERAL_STRING("file"), eIgnoreCase) &&
+        mState.frame && mState.siblingIndex < 0)  {
+      mState.domNode = do_QueryInterface(mState.frame->GetContent());
+      mState.siblingIndex = eSiblingsWalkFrames;
+    }
   }
   else {
     mState.frame = mState.frame->GetNextSibling();
diff --git a/mozilla/layout/forms/nsFileControlFrame.cpp b/mozilla/layout/forms/nsFileControlFrame.cpp
index f402badd2cd..a89c1817d95 100644
--- a/mozilla/layout/forms/nsFileControlFrame.cpp
+++ b/mozilla/layout/forms/nsFileControlFrame.cpp
@@ -70,6 +70,9 @@
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
 #include "nsDisplayList.h"
+#ifdef ACCESSIBILITY
+#include "nsIAccessibilityService.h"
+#endif
 
 #define SYNC_TEXT 0x1
 #define SYNC_BUTTON 0x2
@@ -598,6 +601,15 @@ nsFileControlFrame::BuildDisplayList(nsDisplayListBuilder*   aBuilder,
   return DisplaySelectionOverlay(aBuilder, aLists);
 }
 
+#ifdef ACCESSIBILITY
+NS_IMETHODIMP nsFileControlFrame::GetAccessible(nsIAccessible** aAccessible)
+{
+  // No accessible object for file control, only for child text frame and button
+  *aAccessible = nsnull;
+  return NS_ERROR_FAILURE;
+}
+#endif
+
 ////////////////////////////////////////////////////////////
 // Mouse listener implementation
 
diff --git a/mozilla/layout/forms/nsFileControlFrame.h b/mozilla/layout/forms/nsFileControlFrame.h
index 09d87b6b180..e23f3578e1b 100644
--- a/mozilla/layout/forms/nsFileControlFrame.h
+++ b/mozilla/layout/forms/nsFileControlFrame.h
@@ -93,6 +93,10 @@ public:
   // nsIAnonymousContentCreator
   virtual nsresult CreateAnonymousContent(nsTArray<nsIContent*>& aElements);
 
+#ifdef ACCESSIBILITY
+  NS_IMETHOD GetAccessible(nsIAccessible** aAccessible);
+#endif
+
 protected:
   class MouseListener;
   friend class MouseListener;