Bug 1524919 - When getting the cell-index object attribute, make sure to only return positive values, r=Jamie

When getting the cell-index object attribute, now take into account that the row index might be invalid, and bail if that's the case. This should prevent negative index values which were one of the causes of Occasional crashes on Linux with weirdly formed tables like in Gmail.

Differential Revision: https://phabricator.services.mozilla.com/D18546

--HG--
extra : moz-landing-system : lando

accessible/generic/ARIAGridAccessible.cpp

@@ -553,6 +553,11 @@ ARIAGridCellAccessible::NativeAttributes() {
   Accessible* thisRow = Row();
   if (!thisRow) return attributes.forget();
 
+  int32_t rowIdx = RowIndexFor(thisRow);
+  if (rowIdx == -1) {  // error
+    return attributes.forget();
+  }
+
   int32_t colIdx = 0, colCount = 0;
   uint32_t childCount = thisRow->ChildCount();
   for (uint32_t childIdx = 0; childIdx < childCount; childIdx++) {
@@ -565,8 +570,6 @@ ARIAGridCellAccessible::NativeAttributes() {
       colCount++;
   }
 
-  int32_t rowIdx = RowIndexFor(thisRow);
-
   nsAutoString stringIdx;
   stringIdx.AppendInt(rowIdx * colCount + colIdx);
   nsAccUtils::SetAccAttr(attributes, nsGkAtoms::tableCellIndex, stringIdx);

accessible/generic/ARIAGridAccessible.h

@@ -114,6 +114,7 @@ class ARIAGridCellAccessible : public HyperTextAccessibleWrap,
 
   /**
    * Return index of the given row.
+   * Returns -1 upon error.
    */
   int32_t RowIndexFor(Accessible* aRow) const;