Bug 597311 - make WM_GETOBJECT return root accessible always, r=davidb, sr=roc, f=marcoz, a=blocking7beta

accessible/public/nsIAccessibilityService.h

@@ -74,6 +74,17 @@ public:
   virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
                                              nsIPresShell* aPresShell) = 0;
 
+  /**
+   * Return root document accessible that is or contains a document accessible
+   * for the given presshell.
+   *
+   * @param aPresShell  [in] the presshell
+   * @param aCanCreate  [in] points whether the root document accessible
+   *                        should be returned from the cache or can be created
+   */
+  virtual nsAccessible* GetRootDocumentAccessible(nsIPresShell* aPresShell,
+                                                  PRBool aCanCreate) = 0;
+
   /**
    * Creates accessible for the given DOM node or frame.
    */
@@ -170,8 +181,7 @@ public:
    * @param aEvent   [in] accessible event type
    * @param aTarget  [in] target of accessible event
    */
-  virtual nsresult FireAccessibleEvent(PRUint32 aEvent,
-                                       nsIAccessible *aTarget) = 0;
+  virtual void FireAccessibleEvent(PRUint32 aEvent, nsAccessible* aTarget) = 0;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsIAccessibilityService,

accessible/src/base/nsAccessibilityService.cpp

@@ -165,18 +165,41 @@ nsAccessibilityService::NotifyOfAnchorJumpTo(nsIContent *aTarget)
 }
 
 // nsIAccessibilityService
-nsresult
+void
 nsAccessibilityService::FireAccessibleEvent(PRUint32 aEvent,
-                                            nsIAccessible *aTarget)
+                                            nsAccessible* aTarget)
 {
-  nsRefPtr<nsAccessible> accessible(do_QueryObject(aTarget));
-  nsEventShell::FireEvent(aEvent, accessible);
-  return NS_OK;
+  nsEventShell::FireEvent(aEvent, aTarget);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 // nsIAccessibilityService
 
+nsAccessible*
+nsAccessibilityService::GetRootDocumentAccessible(nsIPresShell* aPresShell,
+                                                  PRBool aCanCreate)
+{
+  nsIDocument* documentNode = aPresShell->GetDocument();
+  if (documentNode) {
+    nsCOMPtr<nsISupports> container = documentNode->GetContainer();
+    nsCOMPtr<nsIDocShellTreeItem> treeItem(do_QueryInterface(container));
+    if (treeItem) {
+      nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
+      treeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
+      if (treeItem != rootTreeItem) {
+        nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(rootTreeItem));
+        nsCOMPtr<nsIPresShell> presShell;
+        docShell->GetPresShell(getter_AddRefs(presShell));
+        documentNode = presShell->GetDocument();
+      }
+
+      return aCanCreate ?
+        GetDocAccessible(documentNode) : GetDocAccessibleFromCache(documentNode);
+    }
+  }
+  return nsnull;
+}
+
 already_AddRefed<nsAccessible>
 nsAccessibilityService::CreateOuterDocAccessible(nsIContent* aContent,
                                                  nsIPresShell* aPresShell)

accessible/src/base/nsAccessibilityService.h

@@ -60,6 +60,8 @@ public:
   // nsIAccessibilityService
   virtual nsAccessible* GetAccessibleInShell(nsINode* aNode,
                                              nsIPresShell* aPresShell);
+  virtual nsAccessible* GetRootDocumentAccessible(nsIPresShell* aPresShell,
+                                                  PRBool aCanCreate);
 
   virtual already_AddRefed<nsAccessible>
     CreateHTMLBRAccessible(nsIContent* aContent, nsIPresShell* aPresShell);
@@ -117,7 +119,7 @@ public:
 
   virtual void PresShellDestroyed(nsIPresShell* aPresShell);
 
-  virtual nsresult FireAccessibleEvent(PRUint32 aEvent, nsIAccessible *aTarget);
+  virtual void FireAccessibleEvent(PRUint32 aEvent, nsAccessible* aTarget);
 
   // nsAccessibiltiyService
 

layout/base/nsPresShell.cpp

@@ -6315,22 +6315,27 @@ PresShell::HandleEvent(nsIView         *aView,
 {
   NS_ASSERTION(aView, "null view");
 
-  if (mIsDestroying || !nsContentUtils::IsSafeToRunScript() ||
+  if (mIsDestroying ||
       (sDisableNonTestMouseEvents && NS_IS_MOUSE_EVENT(aEvent) &&
        !(aEvent->flags & NS_EVENT_FLAG_SYNTHETIC_TEST_EVENT))) {
     return NS_OK;
   }
 
-  NS_TIME_FUNCTION_MIN(1.0);
-
 #ifdef ACCESSIBILITY
   if (aEvent->eventStructType == NS_ACCESSIBLE_EVENT) {
+    NS_TIME_FUNCTION_MIN(1.0);
+
     // Accessibility events come through OS requests and not from scripts,
     // so it is safe to handle here
     return HandleEventInternal(aEvent, aView, aEventStatus);
   }
 #endif
 
+  if (!nsContentUtils::IsSafeToRunScript())
+    return NS_OK;
+
+  NS_TIME_FUNCTION_MIN(1.0);
+
   nsIContent* capturingContent =
     NS_IS_MOUSE_EVENT(aEvent) ? GetCapturingContent() : nsnull;
 
@@ -6817,7 +6822,10 @@ PresShell::HandleEventInternal(nsEvent* aEvent, nsIView *aView,
         return NS_OK;
       }
 
-      accEvent->mAccessible = accService->GetAccessibleInShell(mDocument, this);
+      // Accessible creation might be not safe so we make sure it's not created
+      // at unsafe times.
+      accEvent->mAccessible =
+        accService->GetRootDocumentAccessible(this, nsContentUtils::IsSafeToRunScript());
 
       // Ensure this is set in case a11y was activated before any
       // nsPresShells existed to observe "a11y-init-or-shutdown" topic

widget/src/gtk2/nsWindow.cpp

@@ -6383,19 +6383,11 @@ nsWindow::DispatchEventToRootAccessible(PRUint32 aEventType)
         return;
     }
 
+    // Get the root document accessible and fire event to it.
     nsAccessible *acc = DispatchAccessibleEvent();
-    if (!acc) {
-        return;
+    if (acc) {
+        accService->FireAccessibleEvent(aEventType, acc);
     }
-
-    nsCOMPtr<nsIAccessibleDocument> accRootDoc;
-    acc->GetRootDocument(getter_AddRefs(accRootDoc));
-    nsCOMPtr<nsIAccessible> rootAcc(do_QueryInterface(accRootDoc));
-    if (!rootAcc) {
-        return;
-    }
-
-    accService->FireAccessibleEvent(aEventType, rootAcc);
 }
 
 void

widget/src/windows/nsWindow.cpp

@@ -7599,14 +7599,7 @@ nsWindow::GetRootAccessible()
   NS_LOG_WMGETOBJECT_THISWND
   NS_LOG_WMGETOBJECT_WND("This Window", mWnd);
 
-  nsAccessible* docAcc = DispatchAccessibleEvent(NS_GETACCESSIBLE);
-  if (!docAcc)
-    return nsnull;
-
-  nsCOMPtr<nsIAccessibleDocument> rootDocAcc;
-  docAcc->GetRootDocument(getter_AddRefs(rootDocAcc));
-  nsRefPtr<nsAccessible> rootAcc(do_QueryObject(rootDocAcc));
-  return rootAcc;
+  return DispatchAccessibleEvent(NS_GETACCESSIBLE);
 }
 
 STDMETHODIMP_(LRESULT)