Title: [139656] branches/chromium/1364
- Revision
- 139656
- Author
- cev...@google.com
- Date
- 2013-01-14 13:31:58 -0800 (Mon, 14 Jan 2013)
Log Message
Merge 139444
BUG=161240
Review URL: https://codereview.chromium.org/11886026
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash-expected.txt (from rev 139444, trunk/LayoutTests/accessibility/corresponding-control-deleted-crash-expected.txt) (0 => 139656)
--- branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash-expected.txt (rev 0)
+++ branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash-expected.txt 2013-01-14 21:31:58 UTC (rev 139656)
@@ -0,0 +1,9 @@
+Make sure that a debug assert is not triggered when a call to RenderBlock::deleteLineBoxTree calls AccessibilityRenderObject::accessibilityIsIgnored which may require the AXObject for a node that is being deleted.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
Copied: branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash.html (from rev 139444, trunk/LayoutTests/accessibility/corresponding-control-deleted-crash.html) (0 => 139656)
--- branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash.html (rev 0)
+++ branches/chromium/1364/LayoutTests/accessibility/corresponding-control-deleted-crash.html 2013-01-14 21:31:58 UTC (rev 139656)
@@ -0,0 +1,42 @@
+
+<!DOCTYPE html>
+<html>
+<head>
+<script src=""
+</head>
+<body>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+ description("Make sure that a debug assert is not triggered when a call to RenderBlock::deleteLineBoxTree calls AccessibilityRenderObject::accessibilityIsIgnored which may require the AXObject for a node that is being deleted.");
+
+ var label = document.createElement('label');
+ label.style.position = 'fixed';
+ document.body.appendChild(label);
+
+ var progress = document.createElement('progress');
+ progress.style.display = 'block';
+ label.appendChild(progress);
+
+ var kbd = document.createElement('kbd');
+ label.appendChild(kbd);
+
+ var labelShadow = label.webkitCreateShadowRoot();
+
+ var select = document.createElement('select');
+ select.setAttribute('multiple', 'multiple');
+ labelShadow.appendChild(select);
+
+ var shadow = document.createElement('shadow');
+ labelShadow.appendChild(shadow);
+
+ select.focus();
+
+ document.body.removeChild(label);
+
+</script>
+<script src=""
+</body>
+</html>
Modified: branches/chromium/1364/Source/WebCore/rendering/RenderObject.cpp (139655 => 139656)
--- branches/chromium/1364/Source/WebCore/rendering/RenderObject.cpp 2013-01-14 21:31:12 UTC (rev 139655)
+++ branches/chromium/1364/Source/WebCore/rendering/RenderObject.cpp 2013-01-14 21:31:58 UTC (rev 139656)
@@ -2372,14 +2372,20 @@
if (frame() && frame()->eventHandler()->autoscrollRenderer() == this)
frame()->eventHandler()->stopAutoscrollTimer(true);
- if (AXObjectCache::accessibilityEnabled()) {
- document()->axObjectCache()->childrenChanged(this->parent());
- document()->axObjectCache()->remove(this);
- }
animation()->cancelAnimations(this);
+ // For accessibility management, notify the parent of the imminent change to its child set.
+ // We do it now, before remove(), while the parent pointer is still available.
+ if (AXObjectCache::accessibilityEnabled())
+ document()->axObjectCache()->childrenChanged(this->parent());
+
remove();
+ // The remove() call above may invoke axObjectCache()->childrenChanged() on the parent, which may require the AX render
+ // object for this renderer. So we remove the AX render object now, after the renderer is removed.
+ if (AXObjectCache::accessibilityEnabled())
+ document()->axObjectCache()->remove(this);
+
// Continuation and first-letter can generate several renderers associated with a single node.
// We only want to clear the node's renderer if we are the associated renderer.
if (node() && node()->renderer() == this)
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
http://lists.webkit.org/mailman/listinfo/webkit-changes
