bug 1113407 - cleanup wrappers on doc shutdown r=davidb

accessible/ipc/DocAccessibleParent.cpp

@@ -146,12 +146,21 @@ DocAccessibleParent::AddChildDoc(DocAccessibleParent* aChildDoc,
   return true;
 }
 
+PLDHashOperator
+DocAccessibleParent::ShutdownAccessibles(ProxyEntry* entry, void*)
+{
+  ProxyDestroyed(entry->mProxy);
+  return PL_DHASH_NEXT;
+}
+
 void
 DocAccessibleParent::ActorDestroy(ActorDestroyReason aWhy)
 {
-  ProxyDestroyed(this);
   MOZ_ASSERT(mChildDocs.IsEmpty(),
       "why wheren't the child docs destroyed already?");
+
+  mAccessibles.EnumerateEntries(ShutdownAccessibles, nullptr);
+  ProxyDestroyed(this);
   mParentDoc ? mParentDoc->RemoveChildDoc(this)
     : GetAccService()->RemoteDocShutdown(this);
 }

accessible/ipc/DocAccessibleParent.h

@@ -105,6 +105,7 @@ private:
   uint32_t AddSubtree(ProxyAccessible* aParent,
                       const nsTArray<AccessibleData>& aNewTree, uint32_t aIdx,
                       uint32_t aIdxInParent);
+  static PLDHashOperator ShutdownAccessibles(ProxyEntry* entry, void* unused);
 
   nsTArray<DocAccessibleParent*> mChildDocs;
   DocAccessibleParent* mParentDoc;

accessible/ipc/ProxyAccessible.h

@@ -27,7 +27,11 @@ public:
   {
     MOZ_COUNT_CTOR(ProxyAccessible);
   }
-  ~ProxyAccessible() { MOZ_COUNT_DTOR(ProxyAccessible); }
+  ~ProxyAccessible()
+  {
+    MOZ_COUNT_DTOR(ProxyAccessible);
+    MOZ_ASSERT(!mWrapper);
+  }
 
   void AddChildAt(uint32_t aIdx, ProxyAccessible* aChild)
   { mChildren.InsertElementAt(aIdx, aChild); }