I mistyped one of surkov's review comments for bug 436453. (And the code does finally make sense to me.) This apparently fixes some mochitests that, for some reason, aren't run on tinderbox.

accessible/src/base/nsAccessibilityUtils.cpp

@@ -794,7 +794,7 @@ nsAccUtils::FindNeighbourPointingToNode(nsIContent *aForNode,
 {
   nsAutoString controlID;
   if (!nsAccUtils::GetID(aForNode, controlID)) {
-    if (aForNode->IsInAnonymousSubtree())
+    if (!aForNode->IsInAnonymousSubtree())
       return nsnull;
 
     aForNode->GetAttr(kNameSpaceID_None, nsAccessibilityAtoms::anonid, controlID);