Bug 333579. Firefox crash with image map areas and accessibility. r=pilgrim, sr=neil

git-svn-id: svn://10.0.0.236/trunk@201919 18797224-902f-48f8-a5cc-f745e15eee43

mozilla/accessible/src/base/nsAccessibilityAtomList.h

@@ -103,6 +103,7 @@ ACCESSIBILITY_ATOM(input, "input")
 ACCESSIBILITY_ATOM(label, "label")
 ACCESSIBILITY_ATOM(li, "li")
 ACCESSIBILITY_ATOM(link, "link")
+ACCESSIBILITY_ATOM(map, "map")
 ACCESSIBILITY_ATOM(math, "math")
 ACCESSIBILITY_ATOM(menu, "menu")    // XUL
 ACCESSIBILITY_ATOM(object, "object")

mozilla/accessible/src/base/nsAccessibilityService.cpp

@@ -1698,6 +1698,15 @@ NS_IMETHODIMP nsAccessibilityService::GetAccessible(nsIDOMNode *aNode,
   }
 #endif
 
+  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
+  if (content && content->Tag() == nsAccessibilityAtoms::map) {
+    // Don't walk into maps, they take up no space.
+    // The nsHTMLAreaAccessible's they contain are attached as
+    // children of the appropriate nsHTMLImageAccessible.
+    *aIsHidden = PR_TRUE;
+    return NS_ERROR_FAILURE;
+  }
+
   // Check to see if we already have an accessible for this
   // node in the cache
   nsCOMPtr<nsIAccessNode> accessNode;
@@ -1717,7 +1726,6 @@ NS_IMETHODIMP nsAccessibilityService::GetAccessible(nsIDOMNode *aNode,
 
   // No cache entry, so we must create the accessible
   // Check to see if hidden first
-  nsCOMPtr<nsIContent> content(do_QueryInterface(aNode));
   nsCOMPtr<nsIDocument> nodeIsDoc;
   if (!content) {
     nodeIsDoc = do_QueryInterface(aNode);

mozilla/accessible/src/html/nsHTMLAreaAccessible.cpp

@@ -51,8 +51,6 @@
 nsHTMLAreaAccessible::nsHTMLAreaAccessible(nsIDOMNode *aDomNode, nsIAccessible *aParent, nsIWeakReference* aShell):
 nsLinkableAccessible(aDomNode, aShell)
 { 
-  Init(); // Make sure we're in cache
-  mParent = aParent;
 }
 
 /* wstring getName (); */

mozilla/accessible/src/html/nsHTMLImageAccessible.cpp

@@ -156,6 +156,10 @@ already_AddRefed<nsIAccessible> nsHTMLImageAccessible::CreateAreaAccessible(PRIn
     accService->GetCachedAccessible(domNode, mWeakShell, &acc);
     if (!acc) {
       accService->CreateHTMLAreaAccessible(mWeakShell, domNode, this, &acc);
+      nsCOMPtr<nsPIAccessNode> accessNode(do_QueryInterface(acc));
+      if (accessNode) {
+        accessNode->Init();
+      }
     }
     return acc;
   }
@@ -202,6 +206,7 @@ void nsHTMLImageAccessible::CacheChildren(PRBool aWalkAnonContent)
 
     privatePrevAccessible = do_QueryInterface(areaAccessible);
     NS_ASSERTION(privatePrevAccessible, "nsIAccessible impl's should always support nsPIAccessible as well");
+    privatePrevAccessible->SetParent(this);
   }
 }
 

mozilla/accessible/src/xul/nsXULSelectAccessible.h

@@ -154,6 +154,8 @@ public:
   NS_IMETHOD GetRole(PRUint32 *_retval);
   NS_IMETHOD GetState(PRUint32 *_retval);
   NS_IMETHOD GetActionName(PRUint8 index, nsAString& _retval);
+  // Don't use XUL menu's special child aggregator, this can be a rich list item
+  NS_IMETHOD GetChildCount(PRInt32 *aAccChildCount) { return nsAccessibleWrap::GetChildCount(aAccChildCount); }
 
 private:
   PRBool mIsCheckbox;

mozilla/accessible/src/xul/nsXULTextAccessible.cpp

@@ -123,6 +123,21 @@ NS_IMETHODIMP nsXULLinkAccessible::GetValue(nsAString& aValue)
   return NS_ERROR_NOT_IMPLEMENTED;
 }
 
+NS_IMETHODIMP nsXULLinkAccessible::GetName(nsAString& aName)
+{ 
+  nsCOMPtr<nsIContent> content(do_QueryInterface(mDOMNode));
+  if (!content) {
+    return NS_ERROR_FAILURE;  // Node shut down
+  }
+  if (!content->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::value,
+                        aName)) {
+    // if the value doesn't exist, flatten the inner content as the name (for descriptions)
+    return AppendFlatStringFromSubtree(content, &aName);
+  }
+  // otherwise, use the value attribute as the name (for labels)
+  return NS_OK;
+}
+
 NS_IMETHODIMP nsXULLinkAccessible::GetRole(PRUint32 *aRole)
 {
   if (mIsLink) {

mozilla/accessible/src/xul/nsXULTextAccessible.h

@@ -71,6 +71,7 @@ class nsXULLinkAccessible : public nsLinkableAccessible
 
 public:
   nsXULLinkAccessible(nsIDOMNode* aDomNode, nsIWeakReference* aShell);
+  NS_IMETHOD GetName(nsAString& _retval); 
   NS_IMETHOD GetRole(PRUint32 *aRole);
   NS_IMETHOD GetValue(nsAString& _retval);