Fix null dereference that happens in accessibilty because FrameView is gone during a nested message loop.

I also fixed another null dereference in InitAccessibilityRoot that I saw during debugging.

BUG=4582
Review URL: http://codereview.chromium.org/10418

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@6098 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 11 insertions, 12 deletions

diff --git a/webkit/glue/glue_accessibility.cc b/webkit/glue/glue_accessibility.cc
index 370bbdb..7119358 100644
--- a/webkit/glue/glue_accessibility.cc
+++ b/webkit/glue/glue_accessibility.cc
@@ -41,6 +41,10 @@ GlueAccessibility::~GlueAccessibility() {
 bool GlueAccessibility::GetAccessibilityInfo(WebView* view,
     const ViewMsg_Accessibility_In_Params& in_params,
     ViewHostMsg_Accessibility_Out_Params* out_params) {
+  WebFrame* main_frame = view->GetMainFrame();
+  if (!main_frame || !static_cast<WebFrameImpl*>(main_frame)->frameview())
+    return false;
+
   if (!root_->accessibility_root_ && !InitAccessibilityRoot(view)) {
     // Failure in retrieving the root.
     return false;
@@ -218,16 +222,11 @@ bool GlueAccessibility::InitAccessibilityRoot(WebView* view) {
   iaccessible_id_ = 0;
 
   WebFrame* main_frame = view->GetMainFrame();
-
-  if (!main_frame)
-    return false;
-
   WebFrameImpl* main_frame_impl = static_cast<WebFrameImpl*>(main_frame);
   WebCore::Frame* frame = main_frame_impl->frame();
-
   WebCore::Document* currentDocument = frame->document();
-  if (!currentDocument) {
-    root_->accessibility_root_ = 0;
+
+  if (!currentDocument || !currentDocument->renderer()) {
     return false;
   } else if (!root_->accessibility_root_ ||
              root_->accessibility_root_->document() != currentDocument) {
diff --git a/webkit/glue/glue_accessibility.h b/webkit/glue/glue_accessibility.h
index 576ccc4..918e71e 100644
--- a/webkit/glue/glue_accessibility.h
+++ b/webkit/glue/glue_accessibility.h
@@ -35,17 +35,17 @@ class GlueAccessibility {
                             const ViewMsg_Accessibility_In_Params& in_params,
                             ViewHostMsg_Accessibility_Out_Params* out_params);
 
-  // Retrieves the RenderObject associated with this WebView, and uses it to
-  // initialize the root of the render-side MSAA tree with the associated
-  // accessibility information. Returns true if successful, false otherwise.
-  bool InitAccessibilityRoot(WebView* view);
-
   // Erases the entry identified by the |iaccessible_id| from the hash map. If
   // |clear_all| is true, all entries are erased. Returns true if successful,
   // false otherwise.
   bool ClearIAccessibleMap(int iaccessible_id, bool clear_all);
 
  private:
+  // Retrieves the RenderObject associated with this WebView, and uses it to
+  // initialize the root of the render-side MSAA tree with the associated
+  // accessibility information. Returns true if successful, false otherwise.
+  bool InitAccessibilityRoot(WebView* view);
+
   // Wrapper around the COM pointer that holds the root of the MSAA tree, to
   // ensure that we are not requiring WebKit includes outside of glue.
   struct GlueAccessibilityRoot;