From 673de145aca9b604ec5c2e2e57f47af46045fa93 Mon Sep 17 00:00:00 2001
From: James Teh <jteh@mozilla.com>
Date: Tue, 30 Jan 2024 01:19:23 +0000
Subject: [PATCH] Bug 1840574: Don't try to get the selection in
 HyperTextAccessible::GetSelectionDOMRanges if the initial tree hasn't been
 constructed yet. r=morgan

Differential Revision: https://phabricator.services.mozilla.com/D199601
---
 accessible/generic/HyperTextAccessible.cpp | 11 +++++++++++
 accessible/generic/LocalAccessible.h       |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/accessible/generic/HyperTextAccessible.cpp b/accessible/generic/HyperTextAccessible.cpp
index 9618c20ad388..cfde6d8a1e02 100644
--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@@ -765,6 +765,17 @@ LayoutDeviceIntRect HyperTextAccessible::GetCaretRect(nsIWidget** aWidget) {
 
 void HyperTextAccessible::GetSelectionDOMRanges(SelectionType aSelectionType,
                                                 nsTArray<nsRange*>* aRanges) {
+  if (IsDoc() && !AsDoc()->HasLoadState(DocAccessible::eTreeConstructed)) {
+    // Rarely, a client query can be handled after a DocAccessible is created
+    // but before the initial tree is constructed, since DoInitialUpdate happens
+    // during a refresh tick. In that case, there might be a DOM selection, but
+    // we can't use it. We will crash if we try due to mContent being null, etc.
+    // This should only happen in the parent process because we should never
+    // try to push the cache in a content process before the initial tree is
+    // constructed.
+    MOZ_ASSERT(XRE_IsParentProcess(), "Query before DoInitialUpdate");
+    return;
+  }
   // Ignore selection if it is not visible.
   RefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection || frameSelection->GetDisplaySelection() <=
diff --git a/accessible/generic/LocalAccessible.h b/accessible/generic/LocalAccessible.h
index e4627f3cf77b..76923de9181d 100644
--- a/accessible/generic/LocalAccessible.h
+++ b/accessible/generic/LocalAccessible.h
@@ -927,7 +927,7 @@ class LocalAccessible : public nsISupports, public Accessible {
 
   // Data Members
   // mContent can be null in a DocAccessible if the document has no body or
-  // root element.
+  // root element, or if the initial tree hasn't been constructed yet.
   nsCOMPtr<nsIContent> mContent;
   RefPtr<DocAccessible> mDoc;