Bug 613466 - crash [@ IDRefsIterator::IDRefsIterator(nsIContent*, nsIAtom*) ], r=davidb, a=beta9+
authorAlexander Surkov <surkov.alexander@gmail.com>
Sat, 20 Nov 2010 10:37:40 +0800
changeset 57934 6c2f603ae217c36304863b522731ddc09a5e49a0
parent 57933 e8c6b728e90a7918a12ddc360ca6a81203e6403b
child 57935 b89d1824a762fa63c8abb02d3bedcb7844b6348b
push id1
push usershaver@mozilla.com
push dateTue, 04 Jan 2011 17:58:04 +0000
reviewersdavidb, beta9
bugs613466
milestone2.0b8pre
Bug 613466 - crash [@ IDRefsIterator::IDRefsIterator(nsIContent*, nsIAtom*) ], r=davidb, a=beta9+
accessible/src/base/nsDocAccessible.cpp
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -1398,30 +1398,32 @@ nsDocAccessible::BindToDocument(nsAccess
   aAccessible->SetRoleMapEntry(aRoleMapEntry);
   AddDependentIDsFor(aAccessible);
   return true;
 }
 
 void
 nsDocAccessible::UnbindFromDocument(nsAccessible* aAccessible)
 {
+  NS_ASSERTION(mAccessibleCache.GetWeak(aAccessible->UniqueID()),
+               "Unbinding the unbound accessible!");
+
   // Remove an accessible from node-to-accessible map if it exists there.
   if (aAccessible->IsPrimaryForNode() &&
       mNodeToAccessibleMap.Get(aAccessible->GetNode()) == aAccessible)
     mNodeToAccessibleMap.Remove(aAccessible->GetNode());
 
-  RemoveDependentIDsFor(aAccessible);
-
-#ifdef DEBUG
-  NS_ASSERTION(mAccessibleCache.GetWeak(aAccessible->UniqueID()),
-               "Unbinding the unbound accessible!");
-#endif
+  if (!aAccessible->IsDefunct())
+    RemoveDependentIDsFor(aAccessible);
 
   void* uniqueID = aAccessible->UniqueID();
+
+  NS_ASSERTION(!aAccessible->IsDefunct(), "Shutdown the shutdown accessible!");
   aAccessible->Shutdown();
+
   mAccessibleCache.Remove(uniqueID);
 }
 
 void
 nsDocAccessible::UpdateTree(nsIContent* aContainerNode,
                             nsIContent* aStartNode,
                             nsIContent* aEndNode,
                             PRBool aIsInsert)