Bug 396799 Menus on the Application menu bar sometimes claim to be menuitems

r=enndeakin, aaronleventhal sr=neil a=dsicore

accessible/src/xul/nsXULMenuAccessible.cpp

@@ -40,6 +40,7 @@
 #include "nsIDOMElement.h"
 #include "nsIDOMXULElement.h"
 #include "nsIMutableArray.h"
+#include "nsIDOMXULContainerElement.h"
 #include "nsIDOMXULSelectCntrlItemEl.h"
 #include "nsIDOMXULMultSelectCntrlEl.h"
 #include "nsIDOMKeyEvent.h"
@@ -462,11 +463,18 @@ nsXULMenuitemAccessible::GetDefaultKeyBinding(nsAString& aKeyBinding)
 
 NS_IMETHODIMP nsXULMenuitemAccessible::GetRole(PRUint32 *aRole)
 {
-  *aRole = nsIAccessibleRole::ROLE_MENUITEM;
+  nsCOMPtr<nsIDOMXULContainerElement> xulContainer(do_QueryInterface(mDOMNode));
+  if (xulContainer) {
+    *aRole = nsIAccessibleRole::ROLE_PARENT_MENUITEM;
+    return NS_OK;
+  }
+
   if (mParent && Role(mParent) == nsIAccessibleRole::ROLE_COMBOBOX_LIST) {
     *aRole = nsIAccessibleRole::ROLE_COMBOBOX_OPTION;
     return NS_OK;
   }
+
+  *aRole = nsIAccessibleRole::ROLE_MENUITEM;
   nsCOMPtr<nsIDOMElement> element(do_QueryInterface(mDOMNode));
   if (!element)
     return NS_ERROR_FAILURE;
@@ -476,13 +484,6 @@ NS_IMETHODIMP nsXULMenuitemAccessible::GetRole(PRUint32 *aRole)
     *aRole = nsIAccessibleRole::ROLE_RADIO_MENU_ITEM;
   else if (menuItemType.EqualsIgnoreCase("checkbox"))
     *aRole = nsIAccessibleRole::ROLE_CHECK_MENU_ITEM;
-  else { // Fortunately, radio/checkbox menuitems don't typically have children
-    PRInt32 childCount;
-    GetChildCount(&childCount);
-    if (childCount > 0) {
-      *aRole = nsIAccessibleRole::ROLE_PARENT_MENUITEM;
-    }
-  }
 
   return NS_OK;
 }

layout/base/nsCSSFrameConstructor.cpp

@@ -6300,11 +6300,12 @@ nsCSSFrameConstructor::ConstructXULFrame(nsFrameConstructorState& aState,
 nsresult
 nsCSSFrameConstructor::AddLazyChildren(nsIContent* aContent,
                                        nsLazyFrameConstructionCallback* aCallback,
-                                       void* aArg)
+                                       void* aArg, PRBool aIsSynch)
 {
   nsCOMPtr<nsIRunnable> event =
     new LazyGenerateChildrenEvent(aContent, mPresShell, aCallback, aArg);
-  return NS_DispatchToCurrentThread(event);
+  return aIsSynch ? event->Run() :
+                    NS_DispatchToCurrentThread(event);
 }
 
 already_AddRefed<nsStyleContext>

layout/base/nsCSSFrameConstructor.h

@@ -128,13 +128,13 @@ public:
   // Process the children of aContent and indicate that frames should be
   // created for them. This is used for lazily built content such as that
   // inside popups so that it is only created when the popup is opened.
-  // This method constructs the frames asynchronously.
+  // If aIsSynch is true, this method constructs the frames synchronously.
   // aCallback will be called with three arguments, the first is the value
   // of aContent, the second is aContent's primary frame, and the third is
   // the value of aArg.
   nsresult AddLazyChildren(nsIContent* aContent,
                            nsLazyFrameConstructionCallback* aCallback,
-                           void* aArg);
+                           void* aArg, PRBool aIsSynch = PR_FALSE);
 
   // Should be called when a frame is going to be destroyed and
   // WillDestroyFrameTree hasn't been called yet.

layout/xul/base/src/nsMenuPopupFrame.cpp

@@ -1539,7 +1539,7 @@ nsMenuPopupFrame::AttributeChanged(PRInt32 aNameSpaceID,
   if (aAttribute == nsGkAtoms::menugenerated &&
       mFrames.IsEmpty() && !mGeneratedChildren) {
     PresContext()->PresShell()->FrameConstructor()->
-      AddLazyChildren(mContent, LazyGeneratePopupDone, nsnull);
+      AddLazyChildren(mContent, LazyGeneratePopupDone, nsnull, PR_TRUE);
   }
   
   return rv;