Bug 735666 - crash [@ nsIDocument::GetContainer() ], r=tbsaunde
--- a/accessible/src/base/NotificationController.cpp
+++ b/accessible/src/base/NotificationController.cpp
@@ -112,18 +112,20 @@ NotificationController::Shutdown()
{
if (mObservingState != eNotObservingRefresh &&
mPresShell->RemoveRefreshObserver(this, Flush_Display)) {
mObservingState = eNotObservingRefresh;
}
// Shutdown handling child documents.
PRInt32 childDocCount = mHangingChildDocuments.Length();
- for (PRInt32 idx = childDocCount - 1; idx >= 0; idx--)
- mHangingChildDocuments[idx]->Shutdown();
+ for (PRInt32 idx = childDocCount - 1; idx >= 0; idx--) {
+ if (!mHangingChildDocuments[idx]->IsDefunct())
+ mHangingChildDocuments[idx]->Shutdown();
+ }
mHangingChildDocuments.Clear();
mDocument = nsnull;
mPresShell = nsnull;
mTextHash.Clear();
mContentInsertions.Clear();
@@ -254,16 +256,18 @@ NotificationController::WillRefresh(mozi
// Process rendered text change notifications.
mTextHash.EnumerateEntries(TextEnumerator, mDocument);
mTextHash.Clear();
// Bind hanging child documents.
PRUint32 hangingDocCnt = mHangingChildDocuments.Length();
for (PRUint32 idx = 0; idx < hangingDocCnt; idx++) {
nsDocAccessible* childDoc = mHangingChildDocuments[idx];
+ if (childDoc->IsDefunct())
+ continue;
nsIContent* ownerContent = mDocument->GetDocumentNode()->
FindContentForSubDocument(childDoc->GetDocumentNode());
if (ownerContent) {
nsAccessible* outerDocAcc = mDocument->GetAccessible(ownerContent);
if (outerDocAcc && outerDocAcc->AppendChild(childDoc)) {
if (mDocument->AppendChildDocument(childDoc))
continue;