AX: Crash when AX trying to create element for an old auto fill element
authorcfleizach@apple.com <cfleizach@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 Mar 2016 00:58:23 +0000 (00:58 +0000)
committercfleizach@apple.com <cfleizach@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Tue, 29 Mar 2016 00:58:23 +0000 (00:58 +0000)
commit1955db839b6f8c9e830ab5ed3086c6c8b71b9a25
tree4f4c5587d9278f06893ec5054c0173021e98c094
parent88446676aeb98d42d5196066a102de67435c631b
AX: Crash when AX trying to create element for an old auto fill element
https://bugs.webkit.org/show_bug.cgi?id=155943

Reviewed by Joanmarie Diggs.

Source/WebCore:

When an auto-fill element is removed, the Node hangs around but the renderer is gone.
In those cases, we can't blindly add the result of getOrCreate to the children array.

Test: accessibility/auto-fill-crash.html

* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::addTextFieldChildren):

LayoutTests:

* accessibility/auto-fill-crash-expected.txt: Added.
* accessibility/auto-fill-crash.html: Added.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@198769 268f45cc-cd09-0410-ab3c-d52691b4dbfc
LayoutTests/ChangeLog
LayoutTests/accessibility/auto-fill-crash-expected.txt [new file with mode: 0644]
LayoutTests/accessibility/auto-fill-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/accessibility/AccessibilityRenderObject.cpp