Bug 399195. Shutdown leaks when a11y active. r=surkov, a=dsicore

accessible/src/base/nsAccessNode.cpp

@@ -225,16 +225,18 @@ nsAccessNode::GetApplicationAccessible()
     if (!gApplicationAccessible)
       return nsnull;
 
+    // Addref on create. Will Release in ShutdownXPAccessibility()
     NS_ADDREF(gApplicationAccessible);
 
     nsresult rv = gApplicationAccessible->Init();
     if (NS_FAILED(rv)) {
       NS_RELEASE(gApplicationAccessible);
+      gApplicationAccessible = nsnull;
       return nsnull;
     }
   }
 
-  NS_ADDREF(gApplicationAccessible);
+  NS_ADDREF(gApplicationAccessible);   // Addref because we're a getter
   return gApplicationAccessible;
 }
 
@@ -297,10 +299,13 @@ void nsAccessNode::ShutdownXPAccessibility()
   NS_IF_RELEASE(sAccService);
 
   nsApplicationAccessibleWrap::Unload();
-  NS_IF_RELEASE(gApplicationAccessible);
-
   ClearCache(gGlobalDocAccessibleCache);
 
+  // Release gApplicationAccessible after everything else is shutdown
+  // so we don't accidently create it again while tearing down root accessibles
+  NS_IF_RELEASE(gApplicationAccessible);
+  gApplicationAccessible = nsnull;  
+
   gIsAccessibilityActive = PR_FALSE;
   NotifyA11yInitOrShutdown();
 }

accessible/src/base/nsCaretAccessible.cpp

@@ -245,8 +245,8 @@ nsCaretAccessible::GetCaretRect(nsIWidget **aOutWidget)
   nsCOMPtr<nsIPresShell> presShell = mRootAccessible->GetPresShellFor(lastNodeWithCaret);
   NS_ENSURE_TRUE(presShell, caretRect);
 
-  nsICaret *caret;
-  presShell->GetCaret(&caret);
+  nsCOMPtr<nsICaret> caret;
+  presShell->GetCaret(getter_AddRefs(caret));
   NS_ENSURE_TRUE(caret, caretRect);
 
   PRBool isCollapsed;

accessible/src/base/nsDocAccessible.cpp

@@ -684,8 +684,9 @@ nsresult nsDocAccessible::AddEventListeners()
   nsCOMPtr<nsIDocShellTreeItem> rootTreeItem;
   docShellTreeItem->GetRootTreeItem(getter_AddRefs(rootTreeItem));
   if (rootTreeItem) {
+    nsCOMPtr<nsIAccessibleDocument> rootAccDoc =
       GetDocAccessibleFor(rootTreeItem, PR_TRUE); // Ensure root accessible is created;
-    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible();
+    nsRefPtr<nsRootAccessible> rootAccessible = GetRootAccessible(); // Then get it as ref ptr
     NS_ENSURE_TRUE(rootAccessible, NS_ERROR_FAILURE);
     nsRefPtr<nsCaretAccessible> caretAccessible = rootAccessible->GetCaretAccessible();
     if (caretAccessible) {

accessible/src/base/nsRootAccessible.cpp

@@ -917,15 +917,16 @@ nsRootAccessible::Init()
 
 NS_IMETHODIMP nsRootAccessible::Shutdown()
 {
+  // Called manually or by nsAccessNode::LastRelease()
+  if (!mWeakShell) {
+    return NS_OK;  // Already shutdown
+  }
+
   nsRefPtr<nsApplicationAccessibleWrap> root = GetApplicationAccessible();
   NS_ENSURE_STATE(root);
 
   root->RemoveRootAccessible(this);
 
-  // Called manually or by nsAccessNode::LastRelease()
-  if (!mWeakShell) {
-    return NS_OK;  // Already shutdown
-  }
   mCurrentARIAMenubar = nsnull;
 
   if (mFireFocusTimer) {