Add additional IsDefunct() checks in State() methods to fix crashes [@ nsIContent::Tag()]. Bug 648988. r=surkov

accessible/src/base/nsAccessible.cpp

@@ -695,9 +695,6 @@ nsAccessible::IsVisible(PRBool* aIsOffscreen)
 PRUint64
 nsAccessible::NativeState()
 {
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   PRUint64 state = 0;
   nsEventStates intrinsicState = mContent->IntrinsicState();
 
@@ -1527,10 +1524,10 @@ nsAccessible::GetState(PRUint32* aState, PRUint32* aExtraState)
 PRUint64
 nsAccessible::State()
 {
-  PRUint64 state = NativeState();
-  if (state & states::DEFUNCT)
-    return state;
+  if (IsDefunct())
+    return states::DEFUNCT;
 
+  PRUint64 state = NativeState();
   // Apply ARIA states to be sure accessible states will be overriden.
   ApplyARIAState(&state);
 

accessible/src/base/nsApplicationAccessible.cpp

@@ -144,7 +144,7 @@ nsApplicationAccessible::GetKeyboardShortcut(nsAString &aKeyboardShortcut)
 PRUint64
 nsApplicationAccessible::State()
 {
-  return NativeState();
+  return IsDefunct() ? states::DEFUNCT : 0;
 }
 
 NS_IMETHODIMP
@@ -375,7 +375,7 @@ nsApplicationAccessible::NativeRole()
 PRUint64
 nsApplicationAccessible::NativeState()
 {
-  return IsDefunct() ? states::DEFUNCT : 0;
+  return 0;
 }
 
 void

accessible/src/base/nsDocAccessible.cpp

@@ -294,10 +294,6 @@ nsDocAccessible::GetDescription(nsAString& aDescription)
 PRUint64
 nsDocAccessible::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   // The root content of the document might be removed so that mContent is
   // out of date.
   PRUint64 state = (mContent->GetCurrentDoc() == mDocument) ?

accessible/src/html/nsHTMLTextAccessible.cpp

@@ -150,7 +150,7 @@ nsHTMLBRAccessible::NativeRole()
 PRUint64
 nsHTMLBRAccessible::NativeState()
 {
-  return IsDefunct() ? states::DEFUNCT : states::READONLY;
+  return states::READONLY;
 }
 
 nsresult

accessible/src/msaa/nsHTMLWin32ObjectAccessible.cpp

@@ -77,10 +77,7 @@ nsHTMLWin32ObjectOwnerAccessible::NativeState()
 {
   // XXX: No HWND means this is windowless plugin which is not accessible in
   // the meantime.
-  if (mHwnd)
-    return nsAccessibleWrap::NativeState();
-
-  return IsDefunct() ? states::DEFUNCT : states::UNAVAILABLE;
+  return mHwnd ? nsAccessibleWrap::NativeState() : states::UNAVAILABLE;
 }
 
 ////////////////////////////////////////////////////////////////////////////////

accessible/src/xforms/nsXFormsAccessible.cpp

@@ -153,10 +153,6 @@ nsXFormsAccessible::GetValue(nsAString& aValue)
 PRUint64
 nsXFormsAccessible::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   NS_ENSURE_TRUE(sXFormsService, 0);
 
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));

accessible/src/xforms/nsXFormsWidgetsAccessible.cpp

@@ -60,10 +60,6 @@ nsXFormsDropmarkerWidgetAccessible::NativeRole()
 PRUint64
 nsXFormsDropmarkerWidgetAccessible::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   PRBool isOpen = PR_FALSE;
   nsCOMPtr<nsIDOMNode> DOMNode(do_QueryInterface(mContent));
   nsresult rv = sXFormsService->IsDropmarkerOpen(DOMNode, &isOpen);

accessible/src/xul/nsXULFormControlAccessible.cpp

@@ -330,10 +330,6 @@ nsXULDropmarkerAccessible::NativeRole()
 PRUint64
 nsXULDropmarkerAccessible::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   return DropmarkerOpen(PR_FALSE) ? states::PRESSED : 0;
 }
 
@@ -815,7 +811,7 @@ nsXULToolbarSeparatorAccessible::NativeRole()
 PRUint64
 nsXULToolbarSeparatorAccessible::NativeState()
 {
-  return IsDefunct() ? states::DEFUNCT : 0;
+  return 0;
 }
 
 ////////////////////////////////////////////////////////////////////////////////

accessible/src/xul/nsXULListboxAccessible.cpp

@@ -67,7 +67,7 @@ nsXULColumnsAccessible::NativeRole()
 PRUint64
 nsXULColumnsAccessible::NativeState()
 {
-  return IsDefunct() ? states::DEFUNCT : states::READONLY;
+  return states::READONLY;
 }
 
 
@@ -90,7 +90,7 @@ nsXULColumnItemAccessible::NativeRole()
 PRUint64
 nsXULColumnItemAccessible::NativeState()
 {
-  return IsDefunct() ? states::DEFUNCT : states::READONLY;
+  return states::READONLY;
 }
 
 NS_IMETHODIMP
@@ -906,12 +906,8 @@ nsXULListitemAccessible::NativeRole()
 PRUint64
 nsXULListitemAccessible::NativeState()
 {
-  if (mIsCheckbox) {
+  if (mIsCheckbox)
     return nsXULMenuitemAccessible::NativeState();
-  }
-
-  if (IsDefunct())
-    return states::DEFUNCT;
 
   PRUint64 states = states::FOCUSABLE | states::SELECTABLE;
 

accessible/src/xul/nsXULTreeAccessible.cpp

@@ -927,10 +927,6 @@ nsXULTreeItemAccessibleBase::GroupPosition(PRInt32 *aGroupLevel,
 PRUint64
 nsXULTreeItemAccessibleBase::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   // focusable and selectable states
   PRUint64 state = states::FOCUSABLE | states::SELECTABLE;
 

accessible/src/xul/nsXULTreeGridAccessible.cpp

@@ -1165,10 +1165,6 @@ nsXULTreeGridCellAccessible::NativeRole()
 PRUint64
 nsXULTreeGridCellAccessible::NativeState()
 {
-
-  if (IsDefunct())
-    return states::DEFUNCT;
-
   // selectable/selected state
   PRUint64 states = states::SELECTABLE;