Created attachment 270871 [details] test case Steps: 1) Load the testcase page 2) Try to traversal every a11y node in html container with accerciser If you're using debug build of Firefox, you will see ###!!! ASSERTION: Stealing child!: '!parent || parent == this', file nsAccessible.cpp, line 467 in terminal 3) Close the page, Firefox crashed.
reusing same <map> will make several nsHTMLImageAccessible have same set of nsHTMLAreaAccessible children. It will crash Firefox when we're shutting down all the accessibles in the page.
I think we should create area accessibles for each image even these images share area nodes. I'll try the approach.
Created attachment 270896 [details] [diff] [review] patch does it help?
the patch looks good. but it seems it doesn't work correctly, I will debug it to find out why.
Created attachment 272466 [details] [diff] [review] patch v2 based on surkov's Updated to HEAD and fixed 2 problems 1) mAccessNodeCache needs to be nsnull by default 2) return created HTMLAreaAccessible in nsHTMLImageAccessible::GetAreaAccessible
Comment on attachment 272466 [details] [diff] [review] patch v2 based on surkov's Ginn, thank you for fixing this.