https://bugs.webkit.org/show_bug.cgi?id=109452

Reviewed by Chris Fleizach.

Source/WebCore:

Send the accessibility childrenChanged notification in
HTMLSelectElement::setRecalcListItems instead of in childrenChanged
so that all possible codepaths are caught.

Test: accessibility/insert-selected-option-into-select-causes-crash.html

* html/HTMLSelectElement.cpp:
(WebCore::HTMLSelectElement::childrenChanged):
(WebCore::HTMLSelectElement::setRecalcListItems):

LayoutTests:

Add test to ensure a crash doesn't happen if a selected option
is added to a select element, which was triggering a code path where
the DOM has added a new child of the select but the accessibility
object never got updated.

* accessibility/insert-selected-option-into-select-causes-crash-expected.txt: Added.
* accessibility/insert-selected-option-into-select-causes-crash.html: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@142631 268f45cc-cd09-0410-ab3c-d52691b4dbfc