Bug 353200. Top crash in nsAccessible::TextLength(). Attempt at fix, definitely we should be doing this in any case. r=surkov

accessible/src/html/nsHTMLLinkAccessible.h

@@ -52,6 +52,7 @@ public:
   NS_IMETHOD GetName(nsAString& _retval); 
   NS_IMETHOD GetRole(PRUint32 *_retval); 
   NS_IMETHOD GetState(PRUint32 *_retval);
+  NS_IMETHOD Shutdown() { mFrame = nsnull; return nsLinkableAccessible::Shutdown(); }
   
   // nsPIAccessNode
   NS_IMETHOD_(nsIFrame *) GetFrame(void);
@@ -61,7 +62,7 @@ public:
                               void *aData);
 
 private:
-  nsIFrame *mFrame;
+  nsIFrame *mFrame;  // XXX What's special about links that we cache frames for them?
 };
 
 #endif  

accessible/src/html/nsHTMLTextAccessible.h

@@ -55,6 +55,7 @@ public:
   NS_IMETHOD GetState(PRUint32 *aState);
   NS_IMETHOD GetRole(PRUint32 *aRole);
   NS_IMETHOD GetAttributes(nsIPersistentProperties **aAttributes);
+  NS_IMETHOD Shutdown() { mFrame = nsnull; return nsTextAccessibleWrap::Shutdown(); }
   
   // nsPIAccessNode
   NS_IMETHOD_(nsIFrame *) GetFrame(void);
@@ -64,6 +65,9 @@ public:
                               void *aData);
 
 private:
+  // We cache frames for text accessibles so that the primary frame map isn't
+  // increased in size just due to accessibility. Normally the primary frame map,
+  // which is used by nsIPresShell::GetPrimaryFrameFor(), does not include text frames
   nsIFrame *mFrame; // Only valid if node is not shut down (mWeakShell != null)
 };