Bug 208265. Accessibility can crash after profile manager window closes. r=kyle, sr=alecf

accessible/src/base/nsDocAccessible.cpp

@@ -569,13 +569,31 @@ void nsDocAccessible::RemoveContentDocListeners()
   target->RemoveEventListener(NS_LITERAL_STRING("DOMNodeInsertedIntoDocument"), this, PR_TRUE);
   target->RemoveEventListener(NS_LITERAL_STRING("DOMNodeRemovedFromDocument"), this, PR_TRUE);
 
+  if (mScrollWatchTimer) {
+    mScrollWatchTimer->Cancel();
+    mScrollWatchTimer = nsnull;
+  }
+
+  if (mDocLoadTimer) {
+    mDocLoadTimer->Cancel();
+    mDocLoadTimer = nsnull;
+  }
+
   nsCOMPtr<nsISupports> container;
   mDocument->GetContainer(getter_AddRefs(container));
+  nsCOMPtr<nsIDocShellTreeItem> docShellTreeItem(do_QueryInterface(container));
+  if (!docShellTreeItem)
+    return;
+
+  PRInt32 itemType;
+  docShellTreeItem->GetItemType(&itemType);
+  if (itemType == nsIDocShellTreeItem::typeContent) {
     nsCOMPtr<nsICommandManager> commandManager = do_GetInterface(container);
     if (commandManager) {
       commandManager->RemoveCommandObserver(this, "obs_documentCreated");
     }
   }
+}
 
 void nsDocAccessible::FireDocLoadFinished()
 {

accessible/src/base/nsRootAccessible.cpp

@@ -203,16 +203,6 @@ NS_IMETHODIMP nsRootAccessible::RemoveEventListeners()
     target->RemoveEventListener(NS_LITERAL_STRING("ListitemStateChange"), NS_STATIC_CAST(nsIDOMXULListener*, this), PR_TRUE);
   }
 
-  if (mScrollWatchTimer) {
-    mScrollWatchTimer->Cancel();
-    mScrollWatchTimer = nsnull;
-  }
-
-  if (mDocLoadTimer) {
-    mDocLoadTimer->Cancel();
-    mDocLoadTimer = nsnull;
-  }
-
   RemoveContentDocListeners();
 
   if (mCaretAccessible) {