Bug 1840574: Don't try to get the selection in HyperTextAccessible::G…

…etSelectionDOMRanges if the initial tree hasn't been constructed yet. r=morgan

Differential Revision: https://phabricator.services.mozilla.com/D199601

accessible/generic/HyperTextAccessible.cpp

@@ -765,6 +765,17 @@ LayoutDeviceIntRect HyperTextAccessible::GetCaretRect(nsIWidget** aWidget) {
 
 void HyperTextAccessible::GetSelectionDOMRanges(SelectionType aSelectionType,
                                                 nsTArray<nsRange*>* aRanges) {
+  if (IsDoc() && !AsDoc()->HasLoadState(DocAccessible::eTreeConstructed)) {
+    // Rarely, a client query can be handled after a DocAccessible is created
+    // but before the initial tree is constructed, since DoInitialUpdate happens
+    // during a refresh tick. In that case, there might be a DOM selection, but
+    // we can't use it. We will crash if we try due to mContent being null, etc.
+    // This should only happen in the parent process because we should never
+    // try to push the cache in a content process before the initial tree is
+    // constructed.
+    MOZ_ASSERT(XRE_IsParentProcess(), "Query before DoInitialUpdate");
+    return;
+  }
   // Ignore selection if it is not visible.
   RefPtr<nsFrameSelection> frameSelection = FrameSelection();
   if (!frameSelection || frameSelection->GetDisplaySelection() <=

accessible/generic/LocalAccessible.h

@@ -927,7 +927,7 @@ class LocalAccessible : public nsISupports, public Accessible {
 
   // Data Members
   // mContent can be null in a DocAccessible if the document has no body or
-  // root element.
+  // root element, or if the initial tree hasn't been constructed yet.
   nsCOMPtr<nsIContent> mContent;
   RefPtr<DocAccessible> mDoc;