Summary tag is exposed with wrong IA2 Role

Source/core/accessibility/AXRenderObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 262 matching lines @@
         return LinkRole;
     }
     if (cssBox && cssBox->isListItem())
         return ListItemRole;
     if (m_renderer->isListMarker())
         return ListMarkerRole;
     if (isHTMLButtonElement(node))
         return buttonRoleType();
     if (isHTMLDetailsElement(node))
         return DetailsRole;
+    if (isHTMLSummaryElement(node)) {
+        if (isHTMLDetailsElement(m_renderer->parent()->node()))

[Mike West, 2014/09/25 13:08:01]

I think you need to null-check parent() here. Otherwise detached nodes will
crash.

[dmazzoni, 2014/09/25 15:19:49]

Also, I think it'd be more correct to check node->parentElement rather than
m_renderer->parent()->node.

The render tree can differ from the node tree in subtle ways. If the details
element has multiple children and some are inline and some are block, the render
tree may have an anonymous block in-between, so the details would not
necessarily be the direct parent of the summary element.

+            return DisclosureTriangleRole;
+        return UnknownRole;
+    }
     if (isHTMLLegendElement(node))
         return LegendRole;
     if (m_renderer->isText())
         return StaticTextRole;
     if (cssBox && cssBox->isImage()) {
         if (isHTMLInputElement(node))
             return ariaHasPopup() ? PopUpButtonRole : ButtonRole;
         if (isSVGImage())
             return SVGRootRole;
         return ImageRole;
@@ skipping 2056 matching lines @@
         if (label && label->renderer()) {
             LayoutRect labelRect = axObjectCache()->getOrCreate(label)->elementRect();
             result.unite(labelRect);
         }
     }
 
     return result;
 }
 
 } // namespace blink