Merge 65095 - Removing an element from an anonymous block causes crash...

WebCore/accessibility/AccessibilityRenderObject.cpp

Index: WebCore/accessibility/AccessibilityRenderObject.cpp
===================================================================
--- WebCore/accessibility/AccessibilityRenderObject.cpp	(revision 55630)
+++ WebCore/accessibility/AccessibilityRenderObject.cpp	(working copy)
@@ -343,10 +343,10 @@
     else if (isInlineWithContinuation(m_renderer->parent())) {
         RenderObject* continuation = toRenderInline(m_renderer->parent())->continuation();
         
-        // Case 4a: continuation is a block - in this case the block itself is the next sibling.
+        // Case 5a: continuation is a block - in this case the block itself is the next sibling.
         if (continuation->isRenderBlock())
             nextSibling = continuation;
-        // Case 4b: continuation is an inline - in this case the inline's first child is the next sibling
+        // Case 5b: continuation is an inline - in this case the inline's first child is the next sibling
         else
             nextSibling = firstChildConsideringContinuation(continuation);
     }
@@ -357,6 +357,13 @@
     return m_renderer->document()->axObjectCache()->getOrCreate(nextSibling);
 }
 
+static RenderBoxModelObject* nextContinuation(RenderObject* renderer)
+{
+    if (renderer->isInline() && !renderer->isReplaced())
+        return toRenderInline(renderer)->continuation();
+    return toRenderBlock(renderer)->inlineElementContinuation();
+}
+    
 AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
 {
     if (!m_renderer)
@@ -367,6 +374,7 @@
     // Case 1: node is a block and is an inline's continuation. Parent
     // is the start of the continuation chain.
     RenderInline* startOfConts = 0;
+    RenderObject* firstChild = 0;
     if (m_renderer->isRenderBlock() && (startOfConts = startOfContinuations(m_renderer)))
         parent = startOfConts;
 
@@ -375,6 +383,20 @@
     else if (parent && parent->isRenderInline() && (startOfConts = startOfContinuations(parent)))
         parent = startOfConts;
 
+    // Case 3: The first sibling is the beginning of a continuation chain. Find the origin of that continuation.
+    else if (parent && (firstChild = parent->firstChild()) && firstChild->node()) {
+        // Get the node's renderer and follow that continuation chain until the first child is found
+        RenderObject* nodeRenderFirstChild = firstChild->node()->renderer();
+        if (nodeRenderFirstChild != firstChild) {
+            for (RenderObject* contsTest = nodeRenderFirstChild; contsTest; contsTest = nextContinuation(contsTest)) {
+                if (contsTest == firstChild) {
+                    parent = nodeRenderFirstChild->parent();
+                    break;
+                }
+            }
+        }
+    }
+        
     if (!parent)
         return 0;
 
@@ -3286,8 +3308,10 @@
             unsigned length = children.size();
             for (unsigned i = 0; i < length; ++i)
                 m_children.append(children[i]);
-        } else
+        } else {
+            ASSERT(obj->renderParentObject() == this);
             m_children.append(obj);
+        }
     }
     
     // for a RenderImage, add the <area> elements as individual accessibility objects