Add a test that confirms there's no crash on accessing properties of AccesibilityObject at the init…

Source/web/WebAXObject.cpp

Index: Source/web/WebAXObject.cpp
diff --git a/Source/web/WebAXObject.cpp b/Source/web/WebAXObject.cpp
index 317a5b0fbaaab01c2b04b91eba8aedd34c4a5b76..f03814b1c3cec73b38c416f8a35af6a43f7a417c 100644
--- a/Source/web/WebAXObject.cpp
+++ b/Source/web/WebAXObject.cpp
@@ -703,6 +703,9 @@ WebAXRole WebAXObject::role() const
 
 unsigned WebAXObject::selectionEnd() const
 {
+    if (m_private->isTextControl())

[dmazzoni, 2014/03/28 06:30:32]

I'm assuming this fixes the crash, but it doesn't make sense and isn't helpful
to fix it here. Can you find the underlying cause of the crash? I'm assuming
it's in AXRenderObject.cpp or further downstream.

[hajimehoshi, 2014/03/28 06:45:08]

I agree with you.

The cause is that there is an assertion at AXRendererObject::selectedTextRange
(https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...),
while AXRendererObject::selectedTextRange could be accessed from any kinds of
AXRendererObjects. I'm afraid I wan't sure these asserts could be eliminated.

BTW, a similar code exists at
https://code.google.com/p/chromium/codesearch#chromium/src/content/renderer/a...
in terms of 'if' check before accessing proprties.

+        return 0;
+
     if (isDetached())
         return 0;
 
@@ -711,6 +714,9 @@ unsigned WebAXObject::selectionEnd() const
 
 unsigned WebAXObject::selectionStart() const
 {
+    if (m_private->isTextControl())
+        return 0;
+
     if (isDetached())
         return 0;
 
@@ -749,6 +755,9 @@ void WebAXObject::setFocused(bool on) const
 
 void WebAXObject::setSelectedTextRange(int selectionStart, int selectionEnd) const
 {
+    if (m_private->isTextControl())
+        return;
+
     if (isDetached())
         return;