Open orca Open some webpages, e.g. Minefield homepage, Google homepage. Crashed. accessible/src/atk/nsXULTreeAccessibleWrap.cpp 265 *_retval = (aIndex - treeCols) % columns; 266 267 return NS_OK; aInde =1, treeCols = 1 columns = 0

Maybe this is related to URL field autocomplete? nsXULTreeAccessibleWrap::GetColumns calls nsAccessible::GetChildCount and got 0 for mAccChildCount

Could GetColumns be returning 0 because the popup hasn't been displayed yet and so doesn't have all the right accessibles?

maybe. I don't need open web pages to reproduce this bug now. just drop down URL autocomplete several times, and shift focus in items with mouse. see also bug 359845. could be a similar cause.

correction: to reproduce this bug, you need to drop down URL autocomplete, and click one url, try several times while orca open GetRowCount works fine mFirstChild->GetChildCount(&colCount); got 0 (mFirstChild is nsXULTreeColumnsAccessibleWrap) This nsXULTreeColumnsAccessible has no accessible child, because anything in it is invisible. (xul:hbox class="tree-scrollable-columns" and xul:treecolpicker)

1287 // Check frame to see if it is hidden 1288 if (!frame || !frame->GetStyleVisibility()->IsVisible()) { 1289 *aIsHidden = PR_TRUE; 1290 } I got aIsHidden = PR_TRUE for treecols children when autocomplete is opening/closing popup. Should we create accessible for cols children despite hidden at that time?

patch to avoid crash

autocomplete tree is collapsed during popup, and is hidden during close popup. We didn't create accessibles for cols in these case. I doubt we should also change 1288 if (!frame || !frame->GetStyleVisibility()->IsVisible()) { to 1288 if (!frame || !frame->GetStyleVisibility()->IsVisibleOrCollapsed()) { or check content parent tag equals treecols I also noticed we get row count from mTreeView->GetRowCount, does it care collapesd or hidden?