Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore •...

Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
https://bugs.webkit.org/show_bug.cgi?id=25428



git-svn-id: svn://svn.chromium.org/blink/trunk@42900 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/LayoutTests/ChangeLog

+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
+        https://bugs.webkit.org/show_bug.cgi?id=25428
+
+        Re-enable test that was crashing
+
+        * platform/mac-snowleopard/Skipped:
+
 2009-04-26  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Dan Bernstein.

third_party/WebKit/LayoutTests/platform/mac-snowleopard/Skipped

-# <rdar://problem/6687808> Crash when running accessibility/table-modification-crash.html
-accessibility/table-modification-crash.html
-
 # <rdar://problem/6530010> NPN_SetException is not working
 plugins/netscape-throw-exception.html
 

third_party/WebKit/WebCore/ChangeLog

+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
+        https://bugs.webkit.org/show_bug.cgi?id=25428
+
+        When marking children as changed in accessibility, we cannot rely on the accessibility parent chain existing.
+        Instead, the render chain needs to be consulted.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+
 2009-04-27  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin Adler.

third_party/WebKit/WebCore/page/AccessibilityRenderObject.cpp

@@ -2276,16 +2276,14 @@ void AccessibilityRenderObject::childrenChanged()
     
     markChildrenDirty();
     
-    // This object may not be accessible (and thus may not appear
-    // in the hierarchy), which means we need to go up the parent
-    // chain and mark the parent's dirty. Ideally, we would want
-    // to only access the next object that is not ignored, but
-    // asking an element if it's ignored can lead to an examination of the
-    // render tree which is dangerous. 
-    // Only parents that already exist must be retrieved, otherwise objects can be created
-    // at bad times
-    for (AccessibilityObject* parent = parentObjectIfExists(); parent; parent = parent->parentObjectIfExists()) {
-        if (parent->isAccessibilityRenderObject())
+    if (!m_renderer)
+        return;
+    
+    // Go up the render parent chain, marking children as dirty.
+    // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (parent && parent->isAccessibilityRenderObject())
             static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
     }
 }