From fb0f6d54cfde67b75746e327ba8793ebe3e8186c Mon Sep 17 00:00:00 2001
From: Alexander Surkov <surkov.alexander@gmail.com>
Date: Mon, 31 Jan 2011 12:04:32 +0800
Subject: [PATCH] Bug 629912 - 4.0b11pre crash [@
 NotificationController::TextEnumerator(nsPtrHashKey<nsIContent>*, void*) ][@
 nsINode::GetFlags()], r=davidb, a=betaN+

---
 accessible/src/base/NotificationController.h |  8 ++++++++
 accessible/src/base/nsAccessible.h           | 11 ++++++++---
 accessible/src/base/nsDocAccessible.cpp      |  3 +++
 accessible/src/base/nsTextAccessible.cpp     |  1 +
 accessible/src/base/nsTextAccessible.h       | 10 ++++++++++
 5 files changed, 30 insertions(+), 3 deletions(-)

diff --git a/accessible/src/base/NotificationController.h b/accessible/src/base/NotificationController.h
index b4e845a68fd..fea7d845dc5 100644
--- a/accessible/src/base/NotificationController.h
+++ b/accessible/src/base/NotificationController.h
@@ -161,6 +161,14 @@ public:
     }
   }
 
+  /**
+   * Cancel pending text update.
+   */
+  inline void CancelTextUpdate(nsIContent* aTextNode)
+  {
+    mTextHash.RemoveEntry(aTextNode);
+  }
+
   /**
    * Pend accessible tree update for content insertion.
    */
diff --git a/accessible/src/base/nsAccessible.h b/accessible/src/base/nsAccessible.h
index 3af5cfb78e0..2d8da6c9738 100644
--- a/accessible/src/base/nsAccessible.h
+++ b/accessible/src/base/nsAccessible.h
@@ -53,12 +53,13 @@
 #include "nsTArray.h"
 #include "nsRefPtrHashtable.h"
 
+class AccEvent;
 class AccGroupInfo;
 class EmbeddedObjCollector;
-class nsHyperTextAccessible;
 class nsAccessible;
-class AccEvent;
+class nsHyperTextAccessible;
 struct nsRoleMapEntry;
+class nsTextAccessible;
 
 struct nsRect;
 class nsIContent;
@@ -359,6 +360,9 @@ public:
   inline bool IsHyperText() const { return mFlags & eHyperTextAccessible; }
   nsHyperTextAccessible* AsHyperText();
 
+  inline bool IsTextLeaf() const { return mFlags & eTextLeafAccessible; }
+  nsTextAccessible* AsTextLeaf();
+
   //////////////////////////////////////////////////////////////////////////////
   // HyperLinkAccessible
 
@@ -499,7 +503,8 @@ protected:
    * @note keep these flags in sync with ChildrenFlags
    */
   enum AccessibleTypes {
-    eHyperTextAccessible = 1 << 2
+    eHyperTextAccessible = 1 << 2,
+    eTextLeafAccessible = 1 << 3
   };
 
   //////////////////////////////////////////////////////////////////////////////
diff --git a/accessible/src/base/nsDocAccessible.cpp b/accessible/src/base/nsDocAccessible.cpp
index 6498d1098a3..b6f7b3971dc 100644
--- a/accessible/src/base/nsDocAccessible.cpp
+++ b/accessible/src/base/nsDocAccessible.cpp
@@ -2057,6 +2057,9 @@ nsDocAccessible::UncacheChildrenInSubtree(nsAccessible* aRoot)
   for (PRUint32 idx = 0; idx < count; idx++)
     UncacheChildrenInSubtree(aRoot->GetCachedChildAt(idx));
 
+  if (aRoot->IsTextLeaf())
+    mNotificationController->CancelTextUpdate(aRoot->GetContent());
+
   if (aRoot->IsPrimaryForNode() &&
       mNodeToAccessibleMap.Get(aRoot->GetNode()) == aRoot)
     mNodeToAccessibleMap.Remove(aRoot->GetNode());
diff --git a/accessible/src/base/nsTextAccessible.cpp b/accessible/src/base/nsTextAccessible.cpp
index 835f3b7840d..bf2f959b145 100644
--- a/accessible/src/base/nsTextAccessible.cpp
+++ b/accessible/src/base/nsTextAccessible.cpp
@@ -48,6 +48,7 @@ nsTextAccessible::
   nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsLinkableAccessible(aContent, aShell)
 {
+  mFlags |= eTextLeafAccessible;
 }
 
 PRUint32
diff --git a/accessible/src/base/nsTextAccessible.h b/accessible/src/base/nsTextAccessible.h
index 0e3c7795824..e928c1d8db4 100644
--- a/accessible/src/base/nsTextAccessible.h
+++ b/accessible/src/base/nsTextAccessible.h
@@ -61,5 +61,15 @@ protected:
 };
 
 
+////////////////////////////////////////////////////////////////////////////////
+// nsAccessible downcast method
+
+inline nsTextAccessible*
+nsAccessible::AsTextLeaf()
+{
+  return mFlags & eTextLeafAccessible ?
+    static_cast<nsTextAccessible*>(this) : nsnull;
+}
+
 #endif