https://bugs.webkit.org/show_bug.cgi?id=107261

Patch by Joanmarie Diggs <jdiggs@igalia.com> on 2013-01-21
Reviewed by Chris Fleizach.

Source/WebCore:

Test: accessibility/table-destroyed-crash.html

Getting the parent table in order to get the role value should not be
done when objects are being destroyed. Also, it does not seem safe to
assume we have an AXObjectCache.

Moving the logic from roleValue() to determineAccessibilityRole() has
the side effect of not being able to verify the cell is in an AXTable
when that AXTable has not yet been created. Therefore isTableCell()
should look to see if it is the descendant of an AXRow.

* accessibility/AccessibilityTableCell.cpp:
(WebCore::AccessibilityTableCell::parentTable):
(WebCore::AccessibilityTableCell::isTableCell):
(WebCore::AccessibilityTableCell::determineAccessibilityRole):
* accessibility/AccessibilityTableCell.h:
(AccessibilityTableCell):

LayoutTests:

Getting the parent table in order to get the role value should not be
done when objects are being destroyed. Also, it does not seem safe to
assume we have an AXObjectCache.

* accessibility/table-destroyed-crash-expected.txt: Added.
* accessibility/table-destroyed-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140340 268f45cc-cd09-0410-ab3c-d52691b4dbfc