Bug 404380. Crash [ @ FireDelayedToolkitEvent ]. Fix part 2. Patch by Ginn Chen. r=aaronlev, a=dsicore

accessible/src/base/nsCaretAccessible.cpp

@@ -73,6 +73,7 @@ void nsCaretAccessible::Shutdown()
   ClearControlSelectionListener(); // Clear the selection listener for the currently focused control
   mLastTextAccessible = nsnull;
   mLastUsedSelection = nsnull;
+  mRootAccessible = nsnull;
 }
 
 nsresult nsCaretAccessible::ClearControlSelectionListener()
@@ -161,6 +162,8 @@ nsresult nsCaretAccessible::RemoveDocSelectionListener(nsIDOMDocument *aDoc)
 
 NS_IMETHODIMP nsCaretAccessible::NotifySelectionChanged(nsIDOMDocument *aDoc, nsISelection *aSel, PRInt16 aReason)
 {
+  NS_ENSURE_TRUE(mRootAccessible, NS_ERROR_FAILURE);
+
   mLastUsedSelection = do_GetWeakReference(aSel);
 
   nsCOMPtr<nsIDocument> doc = do_QueryInterface(aDoc);

accessible/src/base/nsDocAccessible.cpp

@@ -542,10 +542,14 @@ NS_IMETHODIMP nsDocAccessible::Init()
 
 NS_IMETHODIMP nsDocAccessible::Destroy()
 {
+  nsresult rv = Shutdown();
+
   if (mWeakShell) {
+    // Remove from the cache after Shutdown(), so that Shutdown() procedures
+    // can find the doc or root accessible in the cache if they need it
     gGlobalDocAccessibleCache.Remove(static_cast<void*>(mWeakShell));
   }
-  return Shutdown();
+  return rv;
 }
 
 NS_IMETHODIMP nsDocAccessible::Shutdown()

accessible/src/base/nsRootAccessible.cpp

@@ -345,12 +345,16 @@ nsresult nsRootAccessible::RemoveEventListeners()
     target->RemoveEventListener(NS_LITERAL_STRING("pagehide"), this, PR_TRUE);
   }
 
+  // Do this before removing clearing caret accessible, so that it can use
+  // shutdown the caret accessible's selection listener
+  nsDocAccessible::RemoveEventListeners();
+
   if (mCaretAccessible) {
     mCaretAccessible->Shutdown();
     mCaretAccessible = nsnull;
   }
 
-  return nsDocAccessible::RemoveEventListeners();
+  return NS_OK;
 }
 
 nsCaretAccessible*