Fixed IAccessible::accNavigate for NAVDIR_NEXT and NAVDIR_PREVIOUS when start object was a simple c…

content/browser/accessibility/browser_accessibility_com_win.cc

Index: content/browser/accessibility/browser_accessibility_com_win.cc
diff --git a/content/browser/accessibility/browser_accessibility_com_win.cc b/content/browser/accessibility/browser_accessibility_com_win.cc
index ef242b933711c44f2fb5b205e18713b48bf0523c..17ff9a29529348f65f1bd3406c917805b88e060d 100644
--- a/content/browser/accessibility/browser_accessibility_com_win.cc
+++ b/content/browser/accessibility/browser_accessibility_com_win.cc
@@ -499,17 +499,25 @@ STDMETHODIMP BrowserAccessibilityComWin::accNavigate(LONG nav_dir,
   if (!owner())
     return E_FAIL;
 
-  // Forward all directions but NAVDIR_ to the platform node implementation.
+  // Forward all non-spatial directions (e.g. NAVDIR_NEXT) to the platform node
+  // implementation.
   if (nav_dir != NAVDIR_DOWN && nav_dir != NAVDIR_UP &&
       nav_dir != NAVDIR_LEFT && nav_dir != NAVDIR_RIGHT) {
     return AXPlatformNodeWin::accNavigate(nav_dir, start, end);
   }
 
+  if (end) {
+    end->vt = VT_EMPTY;
+  } else {
+    return E_INVALIDARG;
+  }
+
   BrowserAccessibilityComWin* target = GetTargetFromChildID(start);
   if (!target)
     return E_INVALIDARG;
 
   BrowserAccessibility* result = nullptr;
+  // Only handle spatial directions for tables here.
   switch (nav_dir) {
     case NAVDIR_DOWN:
       result = target->owner()->GetTableCell(
@@ -531,10 +539,8 @@ STDMETHODIMP BrowserAccessibilityComWin::accNavigate(LONG nav_dir,
       break;
   }
 
-  if (!result) {
-    end->vt = VT_EMPTY;
+  if (!result)
     return S_FALSE;
-  }
 
   end->vt = VT_DISPATCH;
   end->pdispVal = ToBrowserAccessibilityComWin(result)->NewReference();