Bug 412878. Crashes when doc load finished. Possibly specific to framed pages. r=surkov, a=schrep.

accessible/src/base/nsAccessibilityService.cpp

@@ -180,25 +180,37 @@ NS_IMETHODIMP nsAccessibilityService::OnStateChange(nsIWebProgress *aWebProgress
 
   nsCOMPtr<nsIDOMDocument> domDoc;
   domWindow->GetDocument(getter_AddRefs(domDoc));
-  nsCOMPtr<nsIDOMNode> domDocRootNode(do_QueryInterface(domDoc));
-  NS_ENSURE_TRUE(domDocRootNode, NS_ERROR_FAILURE);
-
-  // Get the accessible for the new document.
-  // If it not created yet this will create it & cache it, as well as 
-  // set up event listeners so that MSAA/ATK toolkit and internal 
-  // accessibility events will get fired.
-  nsCOMPtr<nsIAccessible> accessible;
-  GetAccessibleFor(domDocRootNode, getter_AddRefs(accessible));
-  nsCOMPtr<nsPIAccessibleDocument> docAccessible =
-    do_QueryInterface(accessible);
-  NS_ENSURE_TRUE(docAccessible, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIDOMNode> domDocNode(do_QueryInterface(domDoc));
+  NS_ENSURE_TRUE(domDocNode, NS_ERROR_FAILURE);
+  nsCOMPtr<nsIAccessibleDocument> docAccessible;
 
   PRUint32 eventType = 0;
-  if ((aStateFlags & STATE_STOP) && NS_SUCCEEDED(aStatus)) {
-    eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE;
-  } else if ((aStateFlags & STATE_STOP) && (aStatus & NS_BINDING_ABORTED)) {
-    eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_STOPPED;
-  } else if (aStateFlags & STATE_START) {
+  if (aStateFlags & STATE_STOP) {
+    // Do not create accessible for page load end events
+    // in case it was already shut down before page finished loading
+    docAccessible = nsAccessNode::GetDocAccessibleFor(domDocNode);  // Cached doc accessibles only
+    if (!docAccessible)
+      return NS_OK;
+    nsCOMPtr<nsIDOMDocument> domDocTest;
+    docAccessible->GetDocument(getter_AddRefs(domDocTest));
+    if (domDocTest != domDoc) {
+      // Doc from accessible is not the doc we started from
+      // We must be shutdown, and domDocTest should be null
+      NS_ASSERTION(!domDocTest, "Doc not shut down but reports incorrect DOM document");
+      return NS_OK;
+    }
+    
+    eventType = NS_FAILED(aStatus) ? nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_STOPPED :
+                                     nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_COMPLETE;
+  }
+  else {
+    // Get the accessible for the new document.
+    // If it not created yet this will create it & cache it, as well as 
+    // set up event listeners so that MSAA/ATK toolkit and internal 
+    // accessibility events will get fired.
+    nsCOMPtr<nsIAccessible> accessible;
+    GetAccessibleFor(domDocNode, getter_AddRefs(accessible));  // Create if necessary
+    docAccessible = do_QueryInterface(accessible);
     eventType = nsIAccessibleEvent::EVENT_DOCUMENT_LOAD_START;
     nsCOMPtr<nsIWebNavigation> webNav(do_GetInterface(domWindow));
     nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(webNav));
@@ -213,11 +225,9 @@ NS_IMETHODIMP nsAccessibilityService::OnStateChange(nsIWebProgress *aWebProgress
     }
   }
       
-  if (eventType == 0)
-    return NS_OK; //no actural event need to be fired
-
-  if (docAccessible) {
-    docAccessible->FireDocLoadEvents(eventType);
+  nsCOMPtr<nsPIAccessibleDocument> privDocAccessible = do_QueryInterface(docAccessible);
+  if (eventType && privDocAccessible) {
+    privDocAccessible->FireDocLoadEvents(eventType);
   }
 
   return NS_OK;

accessible/src/base/nsRootAccessible.cpp

@@ -393,11 +393,8 @@ void nsRootAccessible::TryFireEarlyLoadEvent(nsIDOMNode *aDocNode)
     return;
   }
 
-  // At minimum, create doc accessible so that events are listened to,
-  // allowing us to see any mutations from a page load handler
-  nsCOMPtr<nsIAccessible> docAccessible;
-  GetAccService()->GetAccessibleFor(aDocNode, getter_AddRefs(docAccessible));
-
+  // The doc accessible should already be created as a result of the
+  // OnStateChange() for the initiation of page loading
   nsCOMPtr<nsIDocShellTreeNode> treeNode(do_QueryInterface(treeItem));
   if (treeNode) {
     PRInt32 subDocuments;
@@ -420,8 +417,10 @@ void nsRootAccessible::TryFireEarlyLoadEvent(nsIDOMNode *aDocNode)
     if (!rootContentAccessible) {
       return;
     }
-    PRUint32 state = State(rootContentAccessible);
-    if (state & nsIAccessibleStates::STATE_BUSY) {
+    PRUint32 state, extState;
+    rootContentAccessible->GetFinalState(&state, &extState);
+    if ((state & nsIAccessibleStates::STATE_BUSY) ||
+        (extState & nsIAccessibleStates::EXT_STATE_DEFUNCT)) {
       // Don't fire page load events on subdocuments for initial page load of entire page
       return;
     }