Bug 420055 - New shutdown crash, patch=aaronlev, r=me, sr=mconnor, approval1.9b4+=mconnor,beltzner

accessible/src/base/nsAccessNode.cpp

@@ -86,6 +86,7 @@ nsIStringBundle *nsAccessNode::gKeyStringBundle = 0;
 nsITimer *nsAccessNode::gDoCommandTimer = 0;
 nsIDOMNode *nsAccessNode::gLastFocusedNode = 0;
 PRBool nsAccessNode::gIsAccessibilityActive = PR_FALSE;
+PRBool nsAccessNode::gIsShuttingDownApp = PR_FALSE;
 PRBool nsAccessNode::gIsCacheDisabled = PR_FALSE;
 PRBool nsAccessNode::gIsFormFillEnabled = PR_FALSE;
 nsAccessNodeHashtable nsAccessNode::gGlobalDocAccessibleCache;
@@ -313,6 +314,8 @@ void nsAccessNode::ShutdownXPAccessibility()
   if (!gIsAccessibilityActive) {
     return;
   }
+  gIsShuttingDownApp = PR_TRUE;
+
   NS_IF_RELEASE(gStringBundle);
   NS_IF_RELEASE(gKeyStringBundle);
   NS_IF_RELEASE(gDoCommandTimer);
@@ -320,7 +323,7 @@ void nsAccessNode::ShutdownXPAccessibility()
   NS_IF_RELEASE(sAccService);
 
   nsApplicationAccessibleWrap::Unload();
-  gGlobalDocAccessibleCache.Enumerate(ClearDocCacheEntry, nsnull);
+  ClearCache(gGlobalDocAccessibleCache);
 
   // Release gApplicationAccessible after everything else is shutdown
   // so we don't accidently create it again while tearing down root accessibles
@@ -796,14 +799,6 @@ PLDHashOperator nsAccessNode::ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAcce
   return PL_DHASH_REMOVE;
 }
 
-PLDHashOperator nsAccessNode::ClearDocCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg)
-{
-  nsCOMPtr<nsPIAccessNode> privateAccessNode(do_QueryInterface(aAccessNode));
-  privateAccessNode->Shutdown();
-
-  return PL_DHASH_NEXT; // nsDocAccessible::Shutdown() removes the doc from doc cache
-}
-
 void
 nsAccessNode::ClearCache(nsAccessNodeHashtable& aCache)
 {

accessible/src/base/nsAccessNode.h

@@ -98,7 +98,6 @@ class nsAccessNode: public nsIAccessNode, public nsPIAccessNode
     static void ClearCache(nsAccessNodeHashtable& aCache);
 
     static PLDHashOperator PR_CALLBACK ClearCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg);
-    static PLDHashOperator PR_CALLBACK ClearDocCacheEntry(const void* aKey, nsCOMPtr<nsIAccessNode>& aAccessNode, void* aUserArg);
 
     // Static cache methods for global document cache
     static already_AddRefed<nsIAccessibleDocument> GetDocAccessibleFor(nsIDocument *aDocument);
@@ -148,6 +147,7 @@ protected:
     static nsIStringBundle *gKeyStringBundle;
     static nsITimer *gDoCommandTimer;
     static PRBool gIsAccessibilityActive;
+    static PRBool gIsShuttingDownApp;
     static PRBool gIsCacheDisabled;
     static PRBool gIsFormFillEnabled;
 

accessible/src/base/nsDocAccessible.cpp

@@ -551,7 +551,9 @@ NS_IMETHODIMP nsDocAccessible::Shutdown()
 
   // Remove from the cache after other parts of Shutdown(), so that Shutdown() procedures
   // can find the doc or root accessible in the cache if they need it.
-  gGlobalDocAccessibleCache.Remove(static_cast<void*>(kungFuDeathGripDoc));
+  // We don't do this during ShutdownAccessibility() because that is already clearing the cache
+  if (!gIsShuttingDownApp)
+    gGlobalDocAccessibleCache.Remove(static_cast<void*>(kungFuDeathGripDoc));
 
   return NS_OK;
 }