AX: Safari fails to load a web page with VoiceOver

https://bugs.webkit.org/show_bug.cgi?id=138849 Reviewed by Mario Sanchez Prada. Source/WebCore: Sometimes an inlineElementContinuation will continue to an inline RenderBlock, so we case this incorrectly and bad things happen. Test: accessibility/inline-block-assertion.html * accessibility/AccessibilityRenderObject.cpp: (WebCore::startOfContinuations): LayoutTests: * accessibility/inline-block-assertion-expected.txt: Added. * accessibility/inline-block-assertion.html: Added. Canonical link: https://commits.webkit.org/156730@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@176321 268f45cc-cd09-0410-ab3c-d52691b4dbfc
WebKit · Nov 19, 2014 · e9987e97e0c501b100a93fc530fac423b9e17e7b · e9987e9
1 parent 3811000
commit e9987e97e0c501b100a93fc530fac423b9e17e7b
Showing 5 changed files with 66 additions and 1 deletion.
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
@@ -1,3 +1,13 @@
+2014-11-19  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: Safari fails to load a web page with VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=138849
+
+        Reviewed by Mario Sanchez Prada.
+
+        * accessibility/inline-block-assertion-expected.txt: Added.
+        * accessibility/inline-block-assertion.html: Added.
+
 2014-11-19  Chris Fleizach  <cfleizach@apple.com>
 
         AX: Screen braille input doesn't work on forms.

diff --git a/LayoutTests/accessibility/inline-block-assertion-expected.txt b/LayoutTests/accessibility/inline-block-assertion-expected.txt
@@ -0,0 +1,11 @@
+
+Make sure that an inline block element is not cast incorrectly causing an assertion.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+ROLE: AXRole: AXWebArea
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/accessibility/inline-block-assertion.html b/LayoutTests/accessibility/inline-block-assertion.html
@@ -0,0 +1,30 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<script src="../resources/js-test-pre.js"></script>
+</head>
+<body id="body">
+
+<embed src="../resources/test.swf" type="application/x-shockwave-flash" allowfullscreen="true" width="362" height="298" data-original-width="425" data-original-height="350">
+<div pseudo="-webkit-plugin-replacement" style="display: inline-block; position: relative; width: 100; height: 100;" id="group">
+<iframe width="100%" id="iframe" style="max-height: 100%" height="350" src="resources/cake.png" frameborder="0" scrolling="no"></iframe>
+</div>
+</embed>
+
+<p id="description"></p>
+<div id="console"></div>
+
+<script>
+
+    description("Make sure that an inline block element is not cast incorrectly causing an assertion.");
+
+    if (window.accessibilityController) {
+        var element = accessibilityController.accessibleElementById("group").childAtIndex(0).childAtIndex(0);
+        debug("ROLE: " + element.role);
+    }
+
+</script>
+
+<script src="../resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
@@ -1,3 +1,17 @@
+2014-11-19  Chris Fleizach  <cfleizach@apple.com>
+
+        AX: Safari fails to load a web page with VoiceOver
+        https://bugs.webkit.org/show_bug.cgi?id=138849
+
+        Reviewed by Mario Sanchez Prada.
+
+        Sometimes an inlineElementContinuation will continue to an inline RenderBlock, so we case this incorrectly and bad things happen.
+
+        Test: accessibility/inline-block-assertion.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::startOfContinuations):
+
 2014-11-19  Zalan Bujtas  <zalan@apple.com>
 
         Simple line layout: RenderTreeAsText should use rangeForRenderer() when dumping simple line text.

diff --git a/Source/WebCore/accessibility/AccessibilityRenderObject.cpp b/Source/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -248,7 +248,7 @@ AccessibilityObject* AccessibilityRenderObject::lastChild() const
 
 static inline RenderInline* startOfContinuations(RenderObject& renderer)
 {
-    if (renderer.isInlineElementContinuation())
+    if (renderer.isInlineElementContinuation() && is<RenderInline>(renderer.node()->renderer()))
         return downcast<RenderInline>(renderer.node()->renderer());
 
     // Blocks with a previous continuation always have a next continuation