Merge 65095 - Removing an element from an anonymous block causes crash...

WebCore/accessibility/AccessibilityRenderObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 325 matching lines @@
 
     // Case 4: node is an inline with a continuation. Next sibling is the next sibling of the end 
     // of the continuation chain.
     else if (isInlineWithContinuation(m_renderer))
         nextSibling = endOfContinuations(m_renderer)->nextSibling();
 
     // Case 5: node has no next sibling, and its parent is an inline with a continuation.
     else if (isInlineWithContinuation(m_renderer->parent())) {
         RenderObject* continuation = toRenderInline(m_renderer->parent())->continuation();
         
-        // Case 4a: continuation is a block - in this case the block itself is the next sibling.
+        // Case 5a: continuation is a block - in this case the block itself is the next sibling.
         if (continuation->isRenderBlock())
             nextSibling = continuation;
-        // Case 4b: continuation is an inline - in this case the inline's first child is the next sibling
+        // Case 5b: continuation is an inline - in this case the inline's first child is the next sibling
         else
             nextSibling = firstChildConsideringContinuation(continuation);
     }
 
     if (!nextSibling)
         return 0;
     
     return m_renderer->document()->axObjectCache()->getOrCreate(nextSibling);
 }
 
+static RenderBoxModelObject* nextContinuation(RenderObject* renderer)
+{
+    if (renderer->isInline() && !renderer->isReplaced())
+        return toRenderInline(renderer)->continuation();
+    return toRenderBlock(renderer)->inlineElementContinuation();
+}
+    
 AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
 {
     if (!m_renderer)
         return 0;
 
     RenderObject* parent = m_renderer->parent();
 
     // Case 1: node is a block and is an inline's continuation. Parent
     // is the start of the continuation chain.
     RenderInline* startOfConts = 0;
+    RenderObject* firstChild = 0;
     if (m_renderer->isRenderBlock() && (startOfConts = startOfContinuations(m_renderer)))
         parent = startOfConts;
 
     // Case 2: node's parent is an inline which is some node's continuation; parent is 
     // the earliest node in the continuation chain.
     else if (parent && parent->isRenderInline() && (startOfConts = startOfContinuations(parent)))
         parent = startOfConts;
 
+    // Case 3: The first sibling is the beginning of a continuation chain. Find the origin of that continuation.
+    else if (parent && (firstChild = parent->firstChild()) && firstChild->node()) {
+        // Get the node's renderer and follow that continuation chain until the first child is found
+        RenderObject* nodeRenderFirstChild = firstChild->node()->renderer();
+        if (nodeRenderFirstChild != firstChild) {
+            for (RenderObject* contsTest = nodeRenderFirstChild; contsTest; contsTest = nextContinuation(contsTest)) {
+                if (contsTest == firstChild) {
+                    parent = nodeRenderFirstChild->parent();
+                    break;
+                }
+            }
+        }
+    }
+        
     if (!parent)
         return 0;
 
     return m_renderer->document()->axObjectCache()->get(parent);
 }
     
 AccessibilityObject* AccessibilityRenderObject::parentObject() const
 {
     if (!m_renderer)
         return 0;
@@ skipping 2891 matching lines @@
         return;
     
     // add all unignored acc children
     for (RefPtr<AccessibilityObject> obj = firstChild(); obj; obj = obj->nextSibling()) {
         if (obj->accessibilityIsIgnored()) {
             obj->updateChildrenIfNecessary();
             AccessibilityChildrenVector children = obj->children();
             unsigned length = children.size();
             for (unsigned i = 0; i < length; ++i)
                 m_children.append(children[i]);
-        } else
+        } else {
+            ASSERT(obj->renderParentObject() == this);
             m_children.append(obj);
+        }
     }
     
     // for a RenderImage, add the <area> elements as individual accessibility objects
     if (m_renderer->isRenderImage()) {
         HTMLMapElement* map = toRenderImage(m_renderer)->imageMap();
         if (map) {
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
                 if (current->hasTagName(areaTag) && current->isLink()) {
@@ skipping 321 matching lines @@
 
     m_roleForMSAA = msaaRoleForRenderer(m_renderer);
 
     if (m_roleForMSAA == UnknownRole)
         m_roleForMSAA = roleValue();
 
     return m_roleForMSAA;
 }
 
 } // namespace WebCore