Bug 1330484 - Part 1: Detect and Shutdown binding accessibles that have lost their actors. r=jimm

In content processes, we want to avoid a situation where a DocAccessible has lost its IPC actor (DocAccessibleChild) but finds itself processing a delayed request to take on child documents.  In this case, we shut down the child documents as they are no longer valid.

accessible/base/NotificationController.cpp

@@ -730,7 +730,9 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime)
   }
   mContentInsertions.Clear();
 
-  // Bind hanging child documents.
+  // Bind hanging child documents unless we are using IPC and the
+  // document has no IPC actor.  If we fail to bind the child doc then
+  // shut it down.
   uint32_t hangingDocCnt = mHangingChildDocuments.Length();
   nsTArray<RefPtr<DocAccessible>> newChildDocs;
   for (uint32_t idx = 0; idx < hangingDocCnt; idx++) {
@@ -738,6 +740,11 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime)
     if (childDoc->IsDefunct())
       continue;
 
+    if (IPCAccessibilityActive() && !mDocument->IPCDoc()) {
+      childDoc->Shutdown();
+      continue;
+    }
+
     nsIContent* ownerContent = mDocument->DocumentNode()->
       FindContentForSubDocument(childDoc->DocumentNode());
     if (ownerContent) {
@@ -755,6 +762,8 @@ NotificationController::WillRefresh(mozilla::TimeStamp aTime)
       childDoc->Shutdown();
     }
   }
+
+  // Clear the hanging documents list, even if we didn't bind them.
   mHangingChildDocuments.Clear();
   MOZ_ASSERT(mDocument, "Illicit document shutdown");
   if (!mDocument) {