From e303de892a6f5e3cca59d7767e2ae73c31113599 Mon Sep 17 00:00:00 2001
From: "aaronleventhal%moonset.net" <aaronleventhal%moonset.net>
Date: Wed, 10 Oct 2007 16:51:45 +0000
Subject: [PATCH] Bug 399195. Shutdown leaks when a11y active. r=surkov,
 a=dsicore

---
 accessible/src/base/nsAccessNode.cpp      | 11 ++++++++---
 accessible/src/base/nsCaretAccessible.cpp |  4 ++--
 accessible/src/base/nsDocAccessible.cpp   |  5 +++--
 accessible/src/base/nsRootAccessible.cpp  |  9 +++++----
 4 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/accessible/src/base/nsAccessNode.cpp b/accessible/src/base/nsAccessNode.cpp
index 08dd7e9303b..e88a0178321 100755
--- a/accessible/src/base/nsAccessNode.cpp
+++ b/accessible/src/base/nsAccessNode.cpp
@@ -225,16 +225,18 @@ nsAccessNode::GetApplicationAccessible()
     if (!gApplicationAccessible)
       return nsnull;
 
+    // Addref on create. Will Release in ShutdownXPAccessibility()
     NS_ADDREF(gApplicationAccessible);
 
     nsresult rv = gApplicationAccessible->Init();
     if (NS_FAILED(rv)) {
       NS_RELEASE(gApplicationAccessible);
+      gApplicationAccessible = nsnull;
       return nsnull;
     }
   }
 
-  NS_ADDREF(gApplicationAccessible);
+  NS_ADDREF(gApplicationAccessible);   // Addref because we're a getter
   return gApplicationAccessible;
 }
 
@@ -297,10 +299,13 @@ void nsAccessNode::ShutdownXPAccessibility()
   NS_IF_RELEASE(sAccService);
 
   nsApplicationAccessibleWrap::Unload();
-  NS_IF_RELEASE(gApplicationAccessible);
-
   ClearCache(gGlobalDocAccessibleCache);
 
+  // Release gApplicationAccessible after everything else is shutdown
+  // so we don't accidently create it again while tearing down root accessibles
+  NS_IF_RELEASE(gApplicationAccessible);
+  gApplicationAccessible = nsnull;  
+
   gIsAccessibilityActive = PR_FALSE;
   NotifyA11yInitOrShutdown();
 }
diff --git a/accessible/src/base/nsCaretAccessible.cpp b/accessible/src/base/nsCaretAccessible.cpp
index 134fe9699f7..23175a0b028 100644
--- a/accessible/src/base/nsCaretAccessible.cpp
+++ b/accessible/src/base/nsCaretAccessible.cpp
@@ -245,8 +245,8 @@ nsCaretAccessible::GetCaretRect(nsIWidget **aOutWidget)
   nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
   NS_ENSURE_TRUE(presShell, caretRect);
 
-  nsICaret *caret;
-  presShell->GetCaret(&caret);
+  nsCOMPtr<nsICaret> caret;
+  presShell->GetCaret(getter_AddRefs(caret));
   NS_ENSURE_TRUE(caret, caretRect);
 
   PRBool isCollapsed;
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index fdcb4881ede..0e7d749800e 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -684,8 +684,9 @@ nsresult nsDocAccessible::AddEventListeners()
   nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
   docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
   if (rootTreeItem) {
-    GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
-    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible();
+    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
+      GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
+    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
     if (caretAccessible) {
diff --git a/accessible/src/base/nsRootAccessible.cpp b/accessible/src/base/nsRootAccessible.cpp
index 7f720f9f490..8ffd84b6a66 100644
--- a/accessible/src/base/nsRootAccessible.cpp
+++ b/accessible/src/base/nsRootAccessible.cpp
@@ -917,15 +917,16 @@ nsRootAccessible::Init()
 
 NS_IMETHODIMP nsRootAccessible::Shutdown()
 {
+  // Called manually or by nsAccessNode::LastRelease()
+  if (!mWeakShell) {
+    return NS_OK;  // Already shutdown
+  }
+
   nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
   NS_ENSURE_STATE(root);
 
   root->RemoveRootAccessible(this);
 
-  // Called manually or by nsAccessNode::LastRelease()
-  if (!mWeakShell) {
-    return NS_OK;  // Already shutdown
-  }
   mCurrentARIAMenubar = nsnull;
 
   if (mFireFocusTimer) {