From ac4e11ca8fd625997ca4eb22611654ef8976f921 Mon Sep 17 00:00:00 2001
From: James Teh <jteh@mozilla.com>
Date: Sun, 11 Feb 2024 11:18:27 +0000
Subject: [PATCH] Bug 1840574: Don't try to get the selection in
 HyperTextAccessible::GetSelectionDOMRanges if the initial tree hasn't been
 constructed yet.  a=pascalc

Original Revision: https://phabricator.services.mozilla.com/D199601

Differential Revision: https://phabricator.services.mozilla.com/D201222
---
 accessible/generic/HyperTextAccessible.cpp | 11 +++++++++++
 accessible/generic/LocalAccessible.h       |  2 +-
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/accessible/generic/HyperTextAccessible.cpp b/accessible/generic/HyperTextAccessible.cpp
index 943ac63c1c94..b5102fa51400 100644
--- a/accessible/generic/HyperTextAccessible.cpp
+++ b/accessible/generic/HyperTextAccessible.cpp
@@ -776,6 +776,17 @@ LayoutDeviceIntRect HyperTextAccessible::GetCaretRect(nsIWidget** aWidget) {
 
 void HyperTextAccessible::GetSelectionDOMRanges(SelectionType aSelectionType,
                                                 nsTArray<nsRange*>* aRanges) {
+  if (IsDoc() && !AsDoc()->HasLoadState(DocAccessible::eTreeConstructed)) {
+    // Rarely, a client query can be handled after a DocAccessible is created
+    // but before the initial tree is constructed, since DoInitialUpdate happens
+    // during a refresh tick. In that case, there might be a DOM selection, but
+    // we can't use it. We will crash if we try due to mContent being null, etc.
+    // This should only happen in the parent process because we should never
+    // try to push the cache in a content process before the initial tree is
+    // constructed.
+    MOZ_ASSERT(XRE_IsParentProcess(), "Query before DoInitialUpdate");
+    return;
+  }
   // Ignore selection if it is not visible.
   RefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection || frameSelection->GetDisplaySelection() <=
diff --git a/accessible/generic/LocalAccessible.h b/accessible/generic/LocalAccessible.h
index e4a4f659f5e2..d1dd0efa8f5b 100644
--- a/accessible/generic/LocalAccessible.h
+++ b/accessible/generic/LocalAccessible.h
@@ -928,7 +928,7 @@ class LocalAccessible : public nsISupports, public Accessible {
 
   // Data Members
   // mContent can be null in a DocAccessible if the document has no body or
-  // root element.
+  // root element, or if the initial tree hasn't been constructed yet.
   nsCOMPtr<nsIContent> mContent;
   RefPtr<DocAccessible> mDoc;