Bug 815055 - crash in nsCoreUtils::IsTabDocument, r=tbsaund

accessible/src/generic/DocAccessible.cpp

@@ -1469,9 +1469,11 @@ DocAccessible::NotifyOfLoading(bool aIsReloading)
 void
 DocAccessible::DoInitialUpdate()
 {
+  if (nsCoreUtils::IsTabDocument(mDocumentNode))
+    mDocFlags |= eTabDocument;
+
   // We provide a virtual cursor if this is a root doc or if it's a tab doc.
-  if (!(mDocumentNode->GetParentDocument()) ||
-      nsCoreUtils::IsTabDocument(mDocumentNode))
+  if (!mDocumentNode->GetParentDocument() || (mDocFlags & eTabDocument))
     mDocFlags |= eCursorable;
 
   mLoadState |= eTreeConstructed;

accessible/src/generic/DocAccessible.h

@@ -493,7 +493,10 @@ protected:
     eScrollInitialized = 1 << 0,
 
     // Whether we support nsIAccessibleCursorable.
-    eCursorable = 1 << 1
+    eCursorable = 1 << 1,
+
+    // Whether the document is a tab document.
+    eTabDocument = 1 << 2
   };
 
   /**

accessible/src/msaa/DocAccessibleWrap.cpp

@@ -223,7 +223,7 @@ DocAccessibleWrap::Shutdown()
   // Do window emulation specific shutdown if emulation was started.
   if (nsWinUtils::IsWindowEmulationStarted()) {
     // Destroy window created for root document.
-    if (nsCoreUtils::IsTabDocument(mDocumentNode)) {
+    if (mDocFlags & eTabDocument) {
       sHWNDCache.Remove(mHWND);
       ::DestroyWindow(static_cast<HWND>(mHWND));
     }
@@ -253,7 +253,7 @@ DocAccessibleWrap::DoInitialUpdate()
 
   if (nsWinUtils::IsWindowEmulationStarted()) {
     // Create window for tab document.
-    if (nsCoreUtils::IsTabDocument(mDocumentNode)) {
+    if (mDocFlags & eTabDocument) {
       mozilla::dom::TabChild* tabChild =
         mozilla::dom::GetTabChildFrom(mDocumentNode->GetShell());