bug 1279984 - avoid invalid proxy OuterDocAccessibles r=davidb

Before binding a child document to an outer doc proxy we need to make sure its
Outer doc proxies are only allowed to have one child which is the document they
own.  So before we bind a proxied document to a proxied outer doc we need to
make sure the outer doc either doesn't have children or has a document we can
unbind.

accessible/ipc/DocAccessibleParent.cpp

@@ -370,6 +370,14 @@ DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
   ProxyAccessible* outerDoc = e->mProxy;
   MOZ_ASSERT(outerDoc);
 
+  // OuterDocAccessibles are expected to only have a document as a child.
+  // However for compatibility we tolerate replacing one document with another
+  // here.
+  if (outerDoc->ChildrenCount() > 1 ||
+      (outerDoc->ChildrenCount() == 1 && !outerDoc->ChildAt(0)->IsDoc())) {
+    return false;
+  }
+
   aChildDoc->mParent = outerDoc;
   outerDoc->SetChildDoc(aChildDoc);
   mChildDocs.AppendElement(aChildDoc);