Bug 403037. Crash when ARIA menu bar closes. r=ginn.chen, a=dsicore

accessible/src/base/nsAccessibleEventData.cpp

@@ -125,6 +125,10 @@ void nsAccEvent::PrepareForEvent(nsIAccessibleEvent *aEvent)
 void nsAccEvent::PrepareForEvent(nsIDOMNode *aEventNode,
                                  PRBool aForceIsFromUserInput)
 {
+  if (!aEventNode) {
+    return;
+  }
+
   gLastEventNodeWeak = aEventNode;
   if (aForceIsFromUserInput) {
     gLastEventFromUserInput = PR_TRUE;

accessible/src/base/nsRootAccessible.cpp

@@ -492,10 +492,14 @@ PRBool nsRootAccessible::FireAccessibleFocusEvent(nsIAccessible *aAccessible,
       PRUint32 naturalRole; // The natural role is the role that this type of element normally has
       finalFocusAccessible->GetRole(&naturalRole);
       if (role != naturalRole) { // Must be a DHTML menuitem
-        mCurrentARIAMenubar =
+        nsCOMPtr<nsIAccessible> menuBarAccessible =
           nsAccUtils::GetAncestorWithRole(finalFocusAccessible, nsIAccessibleRole::ROLE_MENUBAR);
-        if (mCurrentARIAMenubar) {
-          nsAccUtils::FireAccEvent(nsIAccessibleEvent::EVENT_MENU_START, mCurrentARIAMenubar);
+        nsCOMPtr<nsIAccessNode> menuBarAccessNode = do_QueryInterface(menuBarAccessible);
+        if (menuBarAccessNode) {
+          menuBarAccessNode->GetDOMNode(getter_AddRefs(mCurrentARIAMenubar));
+          if (mCurrentARIAMenubar) {
+            nsAccUtils::FireAccEvent(nsIAccessibleEvent::EVENT_MENU_START, menuBarAccessible);
+          }
         }
       }
     }

accessible/src/base/nsRootAccessible.h

@@ -125,7 +125,7 @@ class nsRootAccessible : public nsDocAccessibleWrap,
     already_AddRefed<nsIDocShellTreeItem>
            GetContentDocShell(nsIDocShellTreeItem *aStart);
     nsRefPtr<nsCaretAccessible> mCaretAccessible;
-    nsCOMPtr<nsIAccessible> mCurrentARIAMenubar;
+    nsCOMPtr<nsIDOMNode> mCurrentARIAMenubar;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsRootAccessible, NS_ROOTACCESSIBLE_IMPL_CID)