Bug 741053 - crash in nsIDocument::GetRootElement, r=tbsaunde

accessible/src/atk/nsRootAccessibleWrap.cpp

@@ -44,8 +44,12 @@
 nsNativeRootAccessibleWrap::nsNativeRootAccessibleWrap(AtkObject *aAccessible):
     nsRootAccessible(nsnull, nsnull, nsnull)
 {
-    g_object_ref(aAccessible);
-    mAtkObject = aAccessible;
+  // XXX: mark the object as defunct to ensure no single internal method is
+  // running on it.
+  mFlags |= eIsDefunct;
+
+  g_object_ref(aAccessible);
+  mAtkObject = aAccessible;
 }
 
 nsNativeRootAccessibleWrap::~nsNativeRootAccessibleWrap()