Before conversion to AXTableCell, isTableCell() should be called.

Before conversion to AXTableCell, isTableCell() should be called.

Asan reported ASSERTION FAILED: !object || (object->isTableCell())
in headerObjectsForColumn. Before conversion to AXTableCell, isTableCell()
should be called on AXObject.

BUG=451773
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=189026

[k.czech, 2015-01-26 11:59:38]

k.czech@samsung.com changed reviewers:
+ dmazzoni@chromium.org

[k.czech, 2015-01-26 11:59:39]

Mac's ASAN reported ASSERTION FAILED: !object || (object->isTableCell()). I'm
not able to open a test case that tracks this crash (permissions denied), but I
guess the reason may come from missing check before casting to AXTableCell.

[dmazzoni, 2015-01-26 22:54:45]

The CQ bit was checked by dmazzoni@chromium.org

[dmazzoni, 2015-01-26 22:54:45]

lgtm

[commit-bot: I haz the power, 2015-01-26 22:55:00]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/874963002/1

[commit-bot: I haz the power, 2015-01-26 22:55:09]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-01-26 22:55:10]

Failed to apply patch for Source/modules/accessibility/AXTableColumn.cpp:
While running patch -p1 --forward --force --no-backup-if-mismatch;
  patching file Source/modules/accessibility/AXTableColumn.cpp
  Hunk #1 FAILED at 90.
  1 out of 1 hunk FAILED -- saving rejects to file
Source/modules/accessibility/AXTableColumn.cpp.rej

Patch:       Source/modules/accessibility/AXTableColumn.cpp
Index: Source/modules/accessibility/AXTableColumn.cpp
diff --git a/Source/modules/accessibility/AXTableColumn.cpp
b/Source/modules/accessibility/AXTableColumn.cpp
index
2f8d5c7161d2337c782abd5952002b29300006fc..183dc8c115d1cbb7e1e231cb6adf686fefa1968e
100644
--- a/Source/modules/accessibility/AXTableColumn.cpp
+++ b/Source/modules/accessibility/AXTableColumn.cpp
@@ -90,7 +90,7 @@ void
AXTableColumn::headerObjectsForColumn(AccessibilityChildrenVector& headers)
                 continue;
 
             AXObject* cell = axObjectCache()->getOrCreate(renderCell->node());
-            if (!cell)
+            if (!cell || !cell->isTableCell())
                 continue;
 
             if (toAXTableCell(cell)->scanToDecideHeaderRole() ==
ColumnHeaderRole)

[k.czech, 2015-01-27 10:29:49]

The CQ bit was checked by k.czech@samsung.com

[commit-bot: I haz the power, 2015-01-27 10:30:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/874963002/20001

[commit-bot: I haz the power, 2015-01-27 11:50:46]

Committed patchset #2 (id:20001) as
https://src.chromium.org/viewvc/blink?view=rev&revision=189026