patches/firefox3-21-atspi2.diff
author rohinis
Tue, 29 Nov 2011 17:32:55 +0000
branchs11express-2010-11
changeset 22234 c23e64da3e06
parent 17285 a3a456985390
permissions -rw-r--r--
2011-11-29 Rohini S <[email protected]> * patches/Python26-22-audio.diff: Fixes CVE-2010-1634 * specs/SUNWPython26.spec: Fixes CR 7085446

diff --git a/accessible/src/atk/nsAccessibleWrap.cpp b/accessible/src/atk/nsAccessibleWrap.cpp
--- a/accessible/src/atk/nsAccessibleWrap.cpp
+++ b/accessible/src/atk/nsAccessibleWrap.cpp
@@ -920,20 +920,20 @@ refChildCB(AtkObject *aAtkObj, gint aChi
     if (!accChild)
         return nsnull;
 
     AtkObject* childAtkObj = nsAccessibleWrap::GetAtkObject(accChild);
 
     NS_ASSERTION(childAtkObj, "Fail to get AtkObj");
     if (!childAtkObj)
         return nsnull;
+    g_object_ref(childAtkObj);
     
     //this will addref parent
     atk_object_set_parent(childAtkObj, aAtkObj);
-    g_object_ref(childAtkObj);
     return childAtkObj;
 }
 
 gint
 getIndexInParentCB(AtkObject *aAtkObj)
 {
     // We don't use nsIAccessible::GetIndexInParent() because
     // for ATK we don't want to include text leaf nodes as children
diff --git a/accessible/src/atk/nsAppRootAccessible.cpp b/accessible/src/atk/nsAppRootAccessible.cpp
--- a/accessible/src/atk/nsAppRootAccessible.cpp
+++ b/accessible/src/atk/nsAppRootAccessible.cpp
@@ -629,44 +629,63 @@ nsApplicationAccessibleWrap::GetNativeIn
         mAtkObject->role = ATK_ROLE_INVALID;
         mAtkObject->layer = ATK_LAYER_INVALID;
     }
 
     *aOutAccessible = mAtkObject;
     return NS_OK;
 }
 
+struct AtkRootAccessibleAddedEvent {
+  AtkObject *app_accessible;
+  AtkObject *root_accessible;
+  PRUint32 index;
+};
+
+gboolean fireRootAccessibleAddedCB(gpointer data)
+{
+    AtkRootAccessibleAddedEvent* eventData = (AtkRootAccessibleAddedEvent*)data;
+    g_signal_emit_by_name(eventData->app_accessible, "children_changed::add",
+                          eventData->index, eventData->root_accessible, NULL);
+    g_object_unref(eventData->app_accessible);
+    g_object_unref(eventData->root_accessible);
+    free(data);
+    
+    return FALSE;
+}
+
 nsresult
 nsApplicationAccessibleWrap::AddRootAccessible(nsIAccessible *aRootAccWrap)
 {
     NS_ENSURE_ARG_POINTER(aRootAccWrap);
 
     // add by weak reference
     nsresult rv = nsApplicationAccessible::AddRootAccessible(aRootAccWrap);
     NS_ENSURE_SUCCESS(rv, rv);
 
     AtkObject *atkAccessible = nsAccessibleWrap::GetAtkObject(aRootAccWrap);
     atk_object_set_parent(atkAccessible, mAtkObject);
 
     PRUint32 count = 0;
     mChildren->GetLength(&count);
-    g_signal_emit_by_name(mAtkObject, "children_changed::add", count - 1,
-                          atkAccessible, NULL);
 
-#ifdef MAI_LOGGING
-    if (NS_SUCCEEDED(rv)) {
-        MAI_LOG_DEBUG(("\nAdd RootAcc=%p OK, count=%d\n",
-                       (void*)aRootAccWrap, count));
+    // Emit children_changed::add in a timeout
+    // to make sure aRootAccWrap is fully initialized.
+    AtkRootAccessibleAddedEvent* eventData = (AtkRootAccessibleAddedEvent*)
+      malloc(sizeof(AtkRootAccessibleAddedEvent));
+    if (eventData) {
+      eventData->app_accessible = mAtkObject;
+      eventData->root_accessible = atkAccessible;
+      eventData->index = count -1;
+      g_object_ref(mAtkObject);
+      g_object_ref(atkAccessible);
+      g_timeout_add(0, fireRootAccessibleAddedCB, eventData);
     }
-    else
-        MAI_LOG_DEBUG(("\nAdd RootAcc=%p Failed, count=%d\n",
-                       (void*)aRootAccWrap, count));
-#endif
 
-    return rv;
+    return NS_OK;
 }
 
 nsresult
 nsApplicationAccessibleWrap::RemoveRootAccessible(nsIAccessible *aRootAccWrap)
 {
     NS_ENSURE_ARG_POINTER(aRootAccWrap);
 
     PRUint32 index = 0;
@@ -676,33 +695,19 @@ nsApplicationAccessibleWrap::RemoveRootA
     nsCOMPtr<nsIWeakReference> weakPtr = do_GetWeakReference(aRootAccWrap);
     rv = mChildren->IndexOf(0, weakPtr, &index);
 
     AtkObject *atkAccessible = nsAccessibleWrap::GetAtkObject(aRootAccWrap);
     atk_object_set_parent(atkAccessible, NULL);
     g_signal_emit_by_name(mAtkObject, "children_changed::remove", index,
                           atkAccessible, NULL);
 
-#ifdef MAI_LOGGING
-    PRUint32 count = 0;
-    mChildren->GetLength(&count);
-
-    if (NS_SUCCEEDED(rv)) {
-        rv = mChildren->RemoveElementAt(index);
-        MAI_LOG_DEBUG(("\nRemove RootAcc=%p, count=%d\n",
-                       (void*)aRootAccWrap, (count-1)));
-    }
-    else
-        MAI_LOG_DEBUG(("\nFail to Remove RootAcc=%p, count=%d\n",
-                       (void*)aRootAccWrap, count));
-#else
     NS_ENSURE_SUCCESS(rv, rv);
     rv = mChildren->RemoveElementAt(index);
 
-#endif
     InvalidateChildren();
     return rv;
 }
 
 void
 nsApplicationAccessibleWrap::PreCreate()
 {
     if (!sATKChecked) {