webKit vbuf backend: Bypass oleacc proxying.

diff --git a/nvdaHelper/vbufBackends/webKit/webKit.cpp b/nvdaHelper/vbufBackends/webKit/webKit.cpp
index efc01c3..24f9105 100644 (file)
--- a/nvdaHelper/vbufBackends/webKit/webKit.cpp
+++ b/nvdaHelper/vbufBackends/webKit/webKit.cpp
@@ -27,14 +27,28 @@ const UINT WM_LRESULT_FROM_IACCESSIBLE = RegisterWindowMessage(L"VBufBackend_lre
 int idCounter = 0;\r
 \r
 IAccessible* IAccessibleFromIdentifier(int docHandle, int ID) {\r
-       int res;\r
-       IAccessible* pacc=NULL;\r
+       // We want to bypass oleacc proxying,\r
+       // so retrieve the IAccessible directly rather than using AccessibleObjectFromEvent.\r
+       LRESULT lres;\r
+       if (!(lres = SendMessage((HWND)docHandle, WM_GETOBJECT, 0, OBJID_CLIENT)))\r
+               return NULL;\r
+       IAccessible* root = NULL;\r
+       if (ObjectFromLresult(lres, IID_IAccessible, 0, (void**)&root) != S_OK)\r
+               return NULL;\r
        VARIANT varChild;\r
-       if((res=AccessibleObjectFromEvent((HWND)docHandle,OBJID_CLIENT,ID,&pacc,&varChild))!=S_OK) {\r
+       varChild.vt = VT_I4;\r
+       varChild.lVal = 0;\r
+       IDispatch* childDisp;\r
+       HRESULT hres = root->get_accChild(varChild, &childDisp);\r
+       root->Release();\r
+       if (hres != S_OK)\r
                return NULL;\r
-       }\r
-       VariantClear(&varChild);\r
-       return pacc;\r
+       IAccessible* childAcc;\r
+       hres = childDisp->QueryInterface(IID_IAccessible, (void**)&childAcc);\r
+       childDisp->Release();\r
+       if (hres != S_OK)\r
+               return NULL;\r
+       return childAcc;\r
 }\r
 \r
 class WebKitVBufStorage_controlFieldNode_t: public VBufStorage_controlFieldNode_t {\r