Spinoff from bug 376924 If the accessibilityService is initialized in any way, it needs to tell JS that it's active. Also IsAccessibilityActive() should use a static global to track this, so that different presShells all agree on whether accessibility is active or not.

Aaron, in bug 376924 you removed GetFrame() methods from HTMLTextAccesible and HTMLBulletListAccessible. I guess nsAccessible::GetFrame and removed GetFrame() may return different frames. I suppose for list bullet should be returned frame for li. Neil guessed that multiline text node may have several frames, therefore removed GetFrame() and nsIAccessible::GetFrame() may be not one and the same.

Multiline test node will return primary frame, which is the one we kept. That should be the same, so I don't see a problem there. For List bullet accessible it is a problem for list bullet bounds. The list bullets are broken anyway for things like character bounds. It's not as big of a problem as the crashing. Because character bounds were wrong anyway I think we need to look at list bullets and their frame usage anyway. Will you file a bug to deal with list bullet bounds and any other usage of frame?