Huw Davies (@huw) commented about dlls/uiautomationcore/uia_provider.c:
- while (1)
- {
hr = IAccessible_get_accChildCount(acc, &child_count);
if (FAILED(hr) || (cur_pos > child_count))
break;
variant_init_i4(&cid, cur_pos);
hr = IAccessible_get_accChild(acc, cid, &disp);
if (FAILED(hr))
break;
if (hr == S_FALSE)
{
if (!msaa_check_acc_state(acc, cid, STATE_SYSTEM_INVISIBLE))
{
*child = acc;
It would be cleaner to addref `acc` here, then unconditional release the returned child in the callers.