Bug 500487 - Crash [@ nsDocAccessible::RemoveEventListeners() ]; r=MarcoZ, r=surkov
authorDavid Bolter <dbolter@mozilla.com>
Sun, 28 Jun 2009 13:45:04 -0400
changeset 29795 4b4a99f918e406e8d00bd7bba8806ba473cb02a7
parent 29794 168dd0eb728303a5da0dfdda9d447fcb8dd6fb42
child 29796 b5a187cf3013881e487fe86fea314ca31b411fe9
push idunknown
push userunknown
push dateunknown
reviewersMarcoZ, surkov
bugs500487
milestone1.9.2a1pre
Bug 500487 - Crash [@ nsDocAccessible::RemoveEventListeners() ]; r=MarcoZ, r=surkov
accessible/src/base/nsDocAccessible.cpp
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -802,18 +802,36 @@ nsresult nsDocAccessible::AddEventListen
 }
 
 nsresult nsDocAccessible::RemoveEventListeners()
 {
   // Remove listeners associated with content documents
   // Remove scroll position listener
   RemoveScrollListener();
 
-  // Remove document observer
-  mDocument->RemoveObserver(this);
+  NS_ASSERTION(mDocument, "No document during removal of listeners.");
+
+  if (mDocument) {
+    mDocument->RemoveObserver(this);
+
+    nsCOMPtr<nsISupports> container = mDocument->GetContainer();
+    nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
+    NS_ASSERTION(docShellTreeItem, "doc should support nsIDocShellTreeItem.");
+
+    if (docShellTreeItem) {
+      PRInt32 itemType;
+      docShellTreeItem->GetItemType(&itemType);
+      if (itemType == nsIDocShellTreeItem::typeContent) {
+        nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
+        if (commandManager) {
+          commandManager->RemoveCommandObserver(this, "obs_documentCreated");
+        }
+      }
+    }
+  }
 
   if (mScrollWatchTimer) {
     mScrollWatchTimer->Cancel();
     mScrollWatchTimer = nsnull;
     NS_RELEASE_THIS(); // Kung fu death grip
   }
 
   nsRefPtr<nsRootAccessible> rootAccessible(GetRootAccessible());
@@ -821,29 +839,16 @@ nsresult nsDocAccessible::RemoveEventLis
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
     if (caretAccessible) {
       // Don't use GetPresShell() which can call Shutdown() if it sees dead pres shell
       nsCOMPtr<nsIPresShell> presShell(do_QueryReferent(mWeakShell));
       caretAccessible->RemoveDocSelectionListener(presShell);
     }
   }
 
-  nsCOMPtr<nsISupports> container = mDocument->GetContainer();
-  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
-  NS_ENSURE_TRUE(docShellTreeItem, NS_ERROR_FAILURE);
-
-  PRInt32 itemType;
-  docShellTreeItem->GetItemType(&itemType);
-  if (itemType == nsIDocShellTreeItem::typeContent) {
-    nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(docShellTreeItem);
-    if (commandManager) {
-      commandManager->RemoveCommandObserver(this, "obs_documentCreated");
-    }
-  }
-
   return NS_OK;
 }
 
 void
 nsDocAccessible::FireAnchorJumpEvent()
 {
   if (!mIsContentLoaded || !mDocument)
     return;