Merge 94716

Source/WebCore/accessibility/AccessibilityRenderObject.cpp

Index: Source/WebCore/accessibility/AccessibilityRenderObject.cpp
===================================================================
--- Source/WebCore/accessibility/AccessibilityRenderObject.cpp	(revision 95431)
+++ Source/WebCore/accessibility/AccessibilityRenderObject.cpp	(working copy)
@@ -1710,7 +1710,7 @@
     // aria-hidden hides this object and any children
     AccessibilityObject* object = parentObject();
     while (object) {
-        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr), "true"))
+        if (equalIgnoringCase(object->getAttribute(aria_hiddenAttr), "true"))
             return true;
         object = object->parentObject();
     }
@@ -3382,7 +3382,7 @@
         if (!parent->isAccessibilityRenderObject())
             continue;
         
-        AccessibilityRenderObject* axParent = static_cast<AccessibilityRenderObject*>(parent);
+        AccessibilityRenderObject* axParent = toAccessibilityRenderObject(parent);
         
         // Send the children changed notification on the first accessibility render object ancestor.
         if (!sentChildrenChanged) {
@@ -3464,7 +3464,12 @@
     // add all unignored acc children
     for (RefPtr<AccessibilityObject> obj = firstChild(); obj; obj = obj->nextSibling()) {
         if (obj->accessibilityIsIgnored()) {
-            obj->updateChildrenIfNecessary();
+
+            // If the parent is asking for this child's children, then either it's the first time (and clearing is a no-op), 
+            // or its visibility has changed. In the latter case, this child may have a stale child cached. 
+            // This can prevent aria-hidden changes from working correctly. Hence, whenever a parent is getting children, ensure data is not stale.
+            obj->clearChildren();
+            
             AccessibilityChildrenVector children = obj->children();
             unsigned length = children.size();
             for (unsigned i = 0; i < length; ++i)