Bug 629912 - 4.0b11pre crash [@ NotificationController::TextEnumerator(nsPtrHashKey<nsIContent>*, void*) ][@ nsINode::GetFlags()], r=davidb, a=betaN+

accessible/src/base/NotificationController.h

@@ -161,6 +161,14 @@ public:
     }
   }
 
+  /**
+   * Cancel pending text update.
+   */
+  inline void CancelTextUpdate(nsIContent* aTextNode)
+  {
+    mTextHash.RemoveEntry(aTextNode);
+  }
+
   /**
    * Pend accessible tree update for content insertion.
    */

accessible/src/base/nsAccessible.h

@@ -53,12 +53,13 @@
 #include "nsTArray.h"
 #include "nsRefPtrHashtable.h"
 
+class AccEvent;
 class AccGroupInfo;
 class EmbeddedObjCollector;
-class nsHyperTextAccessible;
 class nsAccessible;
-class AccEvent;
+class nsHyperTextAccessible;
 struct nsRoleMapEntry;
+class nsTextAccessible;
 
 struct nsRect;
 class nsIContent;
@@ -359,6 +360,9 @@ public:
   inline bool IsHyperText() const { return mFlags & eHyperTextAccessible; }
   nsHyperTextAccessible* AsHyperText();
 
+  inline bool IsTextLeaf() const { return mFlags & eTextLeafAccessible; }
+  nsTextAccessible* AsTextLeaf();
+
   //////////////////////////////////////////////////////////////////////////////
   // HyperLinkAccessible
 
@@ -499,7 +503,8 @@ protected:
    * @note keep these flags in sync with ChildrenFlags
    */
   enum AccessibleTypes {
-    eHyperTextAccessible = 1 << 2
+    eHyperTextAccessible = 1 << 2,
+    eTextLeafAccessible = 1 << 3
   };
 
   //////////////////////////////////////////////////////////////////////////////

accessible/src/base/nsDocAccessible.cpp

@@ -2057,6 +2057,9 @@ nsDocAccessible::UncacheChildrenInSubtree(nsAccessible* aRoot)
   for (PRUint32 idx = 0; idx < count; idx++)
     UncacheChildrenInSubtree(aRoot->GetCachedChildAt(idx));
 
+  if (aRoot->IsTextLeaf())
+    mNotificationController->CancelTextUpdate(aRoot->GetContent());
+
   if (aRoot->IsPrimaryForNode() &&
       mNodeToAccessibleMap.Get(aRoot->GetNode()) == aRoot)
     mNodeToAccessibleMap.Remove(aRoot->GetNode());

accessible/src/base/nsTextAccessible.cpp

@@ -48,6 +48,7 @@ nsTextAccessible::
   nsTextAccessible(nsIContent *aContent, nsIWeakReference *aShell) :
   nsLinkableAccessible(aContent, aShell)
 {
+  mFlags |= eTextLeafAccessible;
 }
 
 PRUint32

accessible/src/base/nsTextAccessible.h

@@ -61,5 +61,15 @@ protected:
 };
 
 
+////////////////////////////////////////////////////////////////////////////////
+// nsAccessible downcast method
+
+inline nsTextAccessible*
+nsAccessible::AsTextLeaf()
+{
+  return mFlags & eTextLeafAccessible ?
+    static_cast<nsTextAccessible*>(this) : nsnull;
+}
+
 #endif