Always check if View::GetWidget() is NULL.

ui/views/accessibility/native_view_accessibility_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/views/accessibility/native_view_accessibility_win.h"
 
 #include <UIAutomationClient.h>
 #include <oleacc.h>
 
 #include <set>
@@ skipping 235 matching lines @@
 void NativeViewAccessibilityWin::Destroy() {
   view_ = NULL;
   Release();
 }
 
 STDMETHODIMP NativeViewAccessibilityWin::accHitTest(
     LONG x_left, LONG y_top, VARIANT* child) {
   if (!child)
     return E_INVALIDARG;
 
-  if (!view_)
+  if (!view_ || !view_->GetWidget())
     return E_FAIL;
 
   // If this is a root view, our widget might have child widgets.
   // Search child widgets first, since they're on top in the z-order.
   if (view_->GetWidget()->GetRootView() == view_) {
     std::vector<Widget*> child_widgets;
     PopulateChildWidgetVector(&child_widgets);
     for (size_t i = 0; i < child_widgets.size(); ++i) {
       Widget* child_widget = child_widgets[i];
       IAccessible* child_accessible =
@@ skipping 187 matching lines @@
   // Navigation performed correctly. Global return for this function, if no
   // error triggered an escape earlier.
   return S_OK;
 }
 
 STDMETHODIMP NativeViewAccessibilityWin::get_accChild(VARIANT var_child,
                                                       IDispatch** disp_child) {
   if (var_child.vt != VT_I4 || !disp_child)
     return E_INVALIDARG;
 
-  if (!view_)
+  if (!view_ || !view_->GetWidget())
     return E_FAIL;
 
   LONG child_id = V_I4(&var_child);
 
   if (child_id == CHILDID_SELF) {
     // Remain with the same dispatch.
     return S_OK;
   }
 
   // If this is a root view, our widget might have child widgets. Include
@@ skipping 51 matching lines @@
 
   *disp_child = child_view->GetNativeViewAccessible();
   (*disp_child)->AddRef();
   return S_OK;
 }
 
 STDMETHODIMP NativeViewAccessibilityWin::get_accChildCount(LONG* child_count) {
   if (!child_count || !view_)
     return E_INVALIDARG;
 
-  if (!view_)
+  if (!view_ || !view_->GetWidget())

[sky, 2013/11/04 21:26:09]

nit: you've got !view_ on 533 too.

[dmazzoni, 2013/11/04 21:31:19]

Done.

     return E_FAIL;
 
   *child_count = view_->child_count();
 
   // If this is a root view, our widget might have child widgets. Include
   // them, too.
   if (view_->GetWidget()->GetRootView() == view_) {
     std::vector<Widget*> child_widgets;
     PopulateChildWidgetVector(&child_widgets);
     *child_count += child_widgets.size();
@@ skipping 838 matching lines @@
   HandleSpecialTextOffset(text, &start_offset);
   ui::TextBoundaryType boundary = IA2TextBoundaryToTextBoundary(ia2_boundary);
   std::vector<int32> line_breaks;
   return ui::FindAccessibleTextBoundary(
       text, line_breaks, boundary, start_offset, direction);
 }
 
 void NativeViewAccessibilityWin::PopulateChildWidgetVector(
     std::vector<Widget*>* result_child_widgets) {
   const Widget* widget = view()->GetWidget();
+  if (!widget)
+    return;
+
   std::set<Widget*> child_widgets;
   Widget::GetAllChildWidgets(widget->GetNativeView(), &child_widgets);
   Widget::GetAllOwnedWidgets(widget->GetNativeView(), &child_widgets);
   for (std::set<Widget*>::const_iterator iter = child_widgets.begin();
            iter != child_widgets.end(); ++iter) {
     Widget* child_widget = *iter;
     if (child_widget == widget)
       continue;
 
     if (!child_widget->IsVisible())
       continue;
 
     if (widget->GetNativeWindowProperty(kWidgetNativeViewHostKey))
       continue;
 
     result_child_widgets->push_back(child_widget);
   }
 }
 
 }  // namespace views