Merge 94864 - Source/WebCore: Assert being hit in AccessibilityRenderObject::addChildren()

Source/WebCore/accessibility/AccessibilityRenderObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 286 matching lines @@
     RenderObject* previousSibling = 0;
 
     // Case 1: The node is a block and is an inline's continuation. In that case, the inline's
     // last child is our previous sibling (or further back in the continuation chain)
     RenderInline* startOfConts;
     if (m_renderer->isRenderBlock() && (startOfConts = startOfContinuations(m_renderer)))
         previousSibling = childBeforeConsideringContinuations(startOfConts, m_renderer);
 
     // Case 2: Anonymous block parent of the end of a continuation - skip all the way to before
     // the parent of the start, since everything in between will be linked up via the continuation.
-    else if (m_renderer->isAnonymousBlock() && firstChildIsInlineContinuation(m_renderer))
-        previousSibling = startOfContinuations(m_renderer->firstChild())->parent()->previousSibling();
+    else if (m_renderer->isAnonymousBlock() && firstChildIsInlineContinuation(m_renderer)) {
+        RenderObject* firstParent = startOfContinuations(m_renderer->firstChild())->parent();
+        while (firstChildIsInlineContinuation(firstParent))
+            firstParent = startOfContinuations(firstParent->firstChild())->parent();
+        previousSibling = firstParent->previousSibling();
+    }
 
     // Case 3: The node has an actual previous sibling
     else if (RenderObject* ps = m_renderer->previousSibling())
         previousSibling = ps;
 
     // Case 4: This node has no previous siblings, but its parent is an inline,
     // and is another node's inline continutation. Follow the continuation chain.
     else if (m_renderer->parent()->isRenderInline() && (startOfConts = startOfContinuations(m_renderer->parent())))
         previousSibling = childBeforeConsideringContinuations(startOfConts, m_renderer->parent()->firstChild());
 
@@ skipping 16 matching lines @@
     RenderObject* nextSibling = 0;
 
     // Case 1: node is a block and has an inline continuation. Next sibling is the inline continuation's
     // first child.
     RenderInline* inlineContinuation;
     if (m_renderer->isRenderBlock() && (inlineContinuation = toRenderBlock(m_renderer)->inlineElementContinuation()))
         nextSibling = firstChildConsideringContinuation(inlineContinuation);
 
     // Case 2: Anonymous block parent of the start of a continuation - skip all the way to
     // after the parent of the end, since everything in between will be linked up via the continuation.
-    else if (m_renderer->isAnonymousBlock() && lastChildHasContinuation(m_renderer))
-        nextSibling = endOfContinuations(m_renderer->lastChild())->parent()->nextSibling();
+    else if (m_renderer->isAnonymousBlock() && lastChildHasContinuation(m_renderer)) {
+        RenderObject* lastParent = endOfContinuations(m_renderer->lastChild())->parent();
+        while (lastChildHasContinuation(lastParent))
+            lastParent = endOfContinuations(lastParent->lastChild())->parent();
+        nextSibling = lastParent->nextSibling();
+    }
 
     // Case 3: node has an actual next sibling
     else if (RenderObject* ns = m_renderer->nextSibling())
         nextSibling = ns;
 
     // Case 4: node is an inline with a continuation. Next sibling is the next sibling of the end 
     // of the continuation chain.
     else if (isInlineWithContinuation(m_renderer))
         nextSibling = endOfContinuations(m_renderer)->nextSibling();
 
@@ skipping 3398 matching lines @@
 
     m_roleForMSAA = msaaRoleForRenderer(m_renderer);
 
     if (m_roleForMSAA == UnknownRole)
         m_roleForMSAA = roleValue();
 
     return m_roleForMSAA;
 }
 
 } // namespace WebCore