Bug 377767. Crash when closing page info dialog at the media tab. r=s…

…urkov

accessible/src/base/nsAccessible.cpp

@@ -456,7 +456,18 @@ NS_IMETHODIMP nsAccessible::SetParent(nsIAccessible *aParent)
 
 NS_IMETHODIMP nsAccessible::SetFirstChild(nsIAccessible *aFirstChild)
 {
+#ifdef DEBUG
+  // If there's parent of this child already, make sure it's us!
+  nsCOMPtr<nsPIAccessible> privChild = do_QueryInterface(aFirstChild);
+  if (privChild) {
+    nsCOMPtr<nsIAccessible> parent;
+    privChild->GetCachedParent(getter_AddRefs(parent));
+    NS_ASSERTION(!parent || parent == this, "Stealing child!");
+  }
+#endif
+
   mFirstChild = aFirstChild;
+
   return NS_OK;
 }
 
@@ -1964,12 +1975,26 @@ nsresult nsAccessible::GetXULName(nsAString& aLabel, PRBool aCanAggregateSubtree
   return aCanAggregateSubtree? AppendFlatStringFromSubtree(content, &aLabel) : NS_OK;
 }
 
+PRBool nsAccessible::IsNodeRelevant(nsIDOMNode *aNode)
+{
+  // Can this node be accessible and attached to
+  // the document's accessible tree?
+  nsCOMPtr<nsIAccessibilityService> accService =
+    do_GetService("@mozilla.org/accessibilityService;1");
+  NS_ENSURE_TRUE(accService, PR_FALSE);
+  nsCOMPtr<nsIDOMNode> relevantNode;
+  accService->GetRelevantContentNodeFor(aNode, getter_AddRefs(relevantNode));
+  return aNode == relevantNode;
+}
+
 NS_IMETHODIMP nsAccessible::FireToolkitEvent(PRUint32 aEvent, nsIAccessible *aTarget, void * aData)
 {
   // Don't fire event for accessible that has been shut down
   if (!mWeakShell)
     return NS_ERROR_FAILURE;
 
+  NS_ENSURE_TRUE(IsNodeRelevant(mDOMNode), NS_ERROR_FAILURE);
+
   nsCOMPtr<nsIAccessibleDocument> docAccessible(GetDocAccessible());
   nsCOMPtr<nsPIAccessible> eventHandlingAccessible(do_QueryInterface(docAccessible));
   if (eventHandlingAccessible)
@@ -1981,6 +2006,11 @@ NS_IMETHODIMP nsAccessible::FireToolkitEvent(PRUint32 aEvent, nsIAccessible *aTa
 NS_IMETHODIMP
 nsAccessible::FireAccessibleEvent(nsIAccessibleEvent *aEvent)
 {
+  NS_ENSURE_ARG_POINTER(aEvent);
+  nsCOMPtr<nsIDOMNode> eventNode;
+  aEvent->GetDOMNode(getter_AddRefs(eventNode));
+  NS_ENSURE_TRUE(IsNodeRelevant(eventNode), NS_ERROR_FAILURE);
+
   nsCOMPtr<nsIObserverService> obsService =
     do_GetService("@mozilla.org/observer-service;1");
   NS_ENSURE_TRUE(obsService, NS_ERROR_FAILURE);

accessible/src/base/nsAccessible.h

@@ -1,4 +1,4 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+ /* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
 /* ***** BEGIN LICENSE BLOCK *****
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -195,6 +195,7 @@ class nsAccessible : public nsAccessNodeWrap,
   static PRBool IsEmbeddedObject(nsIAccessible *aAcc) { PRUint32 role = Role(aAcc); return role != nsIAccessibleRole::ROLE_TEXT_LEAF && role != nsIAccessibleRole::ROLE_WHITESPACE && role != nsIAccessibleRole::ROLE_STATICTEXT; }
   static PRInt32 TextLength(nsIAccessible *aAccessible);
   static PRBool IsLeaf(nsIAccessible *aAcc) { PRInt32 numChildren; aAcc->GetChildCount(&numChildren); return numChildren > 0; }
+  static PRBool IsNodeRelevant(nsIDOMNode *aNode); // Is node something that could have an attached accessible
 
   already_AddRefed<nsIAccessible> GetParent() {
     nsIAccessible *parent = nsnull;

accessible/src/base/nsDocAccessible.cpp

@@ -913,7 +913,7 @@ nsDocAccessible::AttributeChanged(nsIDocument *aDocument, nsIContent* aContent,
 
   nsCOMPtr<nsIDOMNode> targetNode(do_QueryInterface(aContent));
   NS_ASSERTION(targetNode, "No node for attr modified");
-  if (!targetNode) {
+  if (!targetNode || !IsNodeRelevant(targetNode)) {
     return;
   }
 
@@ -1350,7 +1350,11 @@ NS_IMETHODIMP nsDocAccessible::InvalidateCacheSubtree(nsIContent *aChild,
   // instead of just the accessible tree, although that would be faster
   // Otherwise we might miss the nsAccessNode's that are not nsAccessible's.
 
+  NS_ENSURE_TRUE(mDOMNode, NS_ERROR_FAILURE);
   nsCOMPtr<nsIDOMNode> childNode = aChild ? do_QueryInterface(aChild) : mDOMNode;
+  if (!IsNodeRelevant(childNode)) {
+    return NS_OK;  // Don't fire event unless it's for an attached accessible
+  }
   if (!mIsContentLoaded && mAccessNodeCache.Count() <= 1) {
     return NS_OK; // Still loading and nothing to invalidate yet
   }