Index: ChangeLog
===================================================================
RCS file: /cvs/gnome/gtkhtml/a11y/ChangeLog,v
retrieving revision 1.17
diff -u -p -r1.17 ChangeLog
--- ChangeLog	6 Jan 2005 07:15:17 -0000	1.17
+++ ChangeLog	19 Jan 2005 08:03:49 -0000
@@ -1,3 +1,17 @@
+2005-01-19  Mengjie Yu  <meng-jie.yu@sun.com>
+
+	* html.c: (html_a11y_get_n_children), (html_a11y_ref_child):
+	fix #70083 check defunct state before ref child.
+
+	* object.c: (gtk_html_a11y_get_n_children),
+	(gtk_html_a11y_ref_child):
+	fix #70083 refuse ref child when parsing. Add judgement to avoid a11y
+		   component access null point.
+
+	* utils.c: (acc_unref):
+	fix #70083 Add defunct state after unref a atk object.
+
+
 2005-01-05  Mengjie Yu  <meng-jie.yu@sun.com>
 
 	Fixes #70871
Index: html.c
===================================================================
RCS file: /cvs/gnome/gtkhtml/a11y/html.c,v
retrieving revision 1.6
diff -u -p -r1.6 html.c
--- html.c	29 Dec 2004 11:23:53 -0000	1.6
+++ html.c	19 Jan 2005 08:03:50 -0000
@@ -211,6 +211,14 @@ html_a11y_get_n_children (AtkObject *acc
 {
 	HTMLObject *parent;
 	gint n_children = 0;
+	AtkStateSet * ss;
+
+	ss = html_a11y_ref_state_set (accessible);
+	if (atk_state_set_contains_state (ss, ATK_STATE_DEFUNCT)) {
+		g_object_unref (ss);
+		return 0;
+	}
+	g_object_unref (ss);
 
 	parent = HTML_A11Y_HTML (accessible);
 	if (parent) {
@@ -227,6 +235,15 @@ html_a11y_ref_child (AtkObject *accessib
 {
 	HTMLObject *parent, *child;
 	AtkObject *accessible_child = NULL;
+
+	AtkStateSet * ss;
+
+	ss = html_a11y_ref_state_set(accessible);
+	if (atk_state_set_contains_state (ss, ATK_STATE_DEFUNCT)) {
+		g_object_unref (ss);	
+		return NULL;
+	}	
+	g_object_unref (ss);
 
 	parent = HTML_A11Y_HTML (accessible);
 	if (parent) {
Index: object.c
===================================================================
RCS file: /cvs/gnome/gtkhtml/a11y/object.c,v
retrieving revision 1.8
diff -u -p -r1.8 object.c
--- object.c	28 Dec 2004 16:00:58 -0000	1.8
+++ object.c	19 Jan 2005 08:03:51 -0000
@@ -166,15 +166,39 @@ gtk_html_a11y_initialize (AtkObject *obj
 	g_object_set_data (G_OBJECT (obj), GTK_HTML_ID, data);
 }
 
+
 static gint
 gtk_html_a11y_get_n_children (AtkObject *accessible)
 {
 	HTMLObject *clue;
 	gint n_children = 0;
+	AtkStateSet *ss;
+
+	if (GTK_HTML_A11Y_GTKHTML (accessible)->engine->parsing)
+		return 0;
+
+	ss = atk_object_ref_state_set (accessible);
+	if (atk_state_set_contains_state (ss, ATK_STATE_DEFUNCT)) {
+		g_object_unref (ss);
+		return 0;
+	}
+	g_object_unref (ss);
 
 	clue = GTK_HTML_A11Y_GTKHTML (accessible)->engine->clue;
-	if (clue)
+	if (clue) {
+		AtkObject *atk_clue = html_utils_get_accessible (clue, NULL);
+		if (atk_clue) {
+			AtkStateSet *ss_clue = atk_object_ref_state_set (atk_clue);
+			if (atk_state_set_contains_state (ss_clue, ATK_STATE_DEFUNCT)) {
+				g_object_unref (ss_clue);
+				return 0;
+			}
+			g_object_unref (ss_clue);
+		}
+		
 		n_children = html_object_get_n_children (GTK_HTML_A11Y_GTKHTML (accessible)->engine->clue);
+	}
+		
 
 	/* printf ("gtk_html_a11y_get_n_children resolves to %d\n", n_children); */
 
@@ -186,8 +210,29 @@ gtk_html_a11y_ref_child (AtkObject *acce
 {
 	HTMLObject *child;
 	AtkObject *accessible_child = NULL;
-	
+	AtkStateSet *ss;
+
+	if (GTK_HTML_A11Y_GTKHTML (accessible)->engine->parsing)
+		return NULL;
+
+	ss = atk_object_ref_state_set (accessible);
+	if (atk_state_set_contains_state (ss, ATK_STATE_DEFUNCT)) {
+		g_object_unref (ss);
+		return NULL;
+	}
+	g_object_unref (ss);
+
 	if (GTK_HTML_A11Y_GTKHTML (accessible)->engine->clue) {
+		AtkObject *atk_clue = html_utils_get_accessible (GTK_HTML_A11Y_GTKHTML (accessible)->engine->clue, NULL);
+		if (atk_clue) {
+			AtkStateSet *ss_clue = atk_object_ref_state_set (atk_clue);
+			if (atk_state_set_contains_state (ss_clue, ATK_STATE_DEFUNCT)) {
+				g_object_unref (ss_clue);
+				return NULL;
+			}
+			g_object_unref (ss_clue);
+		}
+
 		child = html_object_get_child (GTK_HTML_A11Y_GTKHTML (accessible)->engine->clue, index);
 		if (child) {
 			accessible_child = html_utils_get_accessible (child, accessible);
Index: utils.c
===================================================================
RCS file: /cvs/gnome/gtkhtml/a11y/utils.c,v
retrieving revision 1.6
diff -u -p -r1.6 utils.c
--- utils.c	29 Dec 2004 11:23:53 -0000	1.6
+++ utils.c	19 Jan 2005 08:03:51 -0000
@@ -95,7 +95,13 @@ create_accessible (HTMLObject *o, AtkObj
 static void
 acc_unref(gpointer data)
 {
+	AtkStateSet * ss;
+
 	g_object_set_data(G_OBJECT(data), HTML_ID, NULL);
+	ss = atk_object_ref_state_set (data);
+
+	atk_state_set_add_state (ss, ATK_STATE_DEFUNCT);
+	atk_object_notify_state_change (data, ATK_STATE_DEFUNCT, TRUE);
 	g_object_unref(G_OBJECT(data));
 }
 
