Merge 65095 - Removing an element from an anonymous block causes crash...

Merge 65095 - Removing an element from an anonymous block causes crash
https://bugs.webkit.org/show_bug.cgi?id=42309

Reviewed by Dave Hyatt.

WebCore: 

There was a case where a continuation was added as a child, but if you asked
that child who is your parent, it would return the wrong answer.
   
The specific scenario was when a sibling of an element who was the start of a 
continuation was present. Retrieving the parent object had then follow the sibling
chain and then follow the originating continuation chain.

Test: accessibility/removed-anonymous-block-child-causes-crash.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::nextSibling):
    Fix erroneous comment
(WebCore::nextContinuation):
(WebCore::AccessibilityRenderObject::renderParentObject):
    Handle unhandled continuation case.
(WebCore::AccessibilityRenderObject::addChildren):
    ASSERT that the parentObject() is the same when adding a new child.

LayoutTests: 

* accessibility/removed-anonymous-block-child-causes-crash-expected.txt: Added.
* accessibility/removed-anonymous-block-child-causes-crash.html: Added.

BUG=47126
TEST=accessibility/removed-anonymous-block-child-causes-crash.html
TBR=dmazzoni@chromium.org


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=55683

[Chris Guillory, 2010-08-10 23:22:07]

There are no try servers setup for the branch. Can I quick CR before I bug this
to the 472 branch. I had to manually merge the changes.