https://bugs.webkit.org/show_bug.cgi?id=111582

Reviewed by Tim Horton.

Source/WebCore: 

There are two ways to create a spin button: from a textfield counter or from ARIA.
If an ARIA spin button is created, it was returning true for isSpinButton, so we were 
casting to the other kind of spin button, leading to a crash.

We need to be more specific about our class types.

Test: platform/mac/accessibility/aria-spinbutton-crash.html

* accessibility/AccessibilityObject.h:
(WebCore::AccessibilityObject::isNativeSpinButton):
* accessibility/AccessibilitySpinButton.h:
(WebCore::AccessibilitySpinButton::isNativeSpinButton):
(WebCore::toAccessibilitySpinButton):
* accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
(-[WebAccessibilityObjectWrapper accessibilityAttributeValue:]):

LayoutTests: 

* platform/mac/accessibility/aria-spinbutton-crash-expected.txt: Added.
* platform/mac/accessibility/aria-spinbutton-crash.html: Added.



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@146727 268f45cc-cd09-0410-ab3c-d52691b4dbfc