Fix crash when assuming that an AREA's parent must be a MAP.

Fix crash when assuming that an AREA's parent must be a MAP.

BUG=246635
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=152090

[inferno, 2013-06-08 22:38:52]

lgtm

[commit-bot: I haz the power, 2013-06-08 22:38:58]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dmazzoni@chromium.org/16647009/1

[inferno, 2013-06-08 22:44:39]

https://codereview.chromium.org/16647009/diff/1/Source/core/accessibility/Acc...
File Source/core/accessibility/AccessibilityRenderObject.cpp (right):

https://codereview.chromium.org/16647009/diff/1/Source/core/accessibility/Acc...
Source/core/accessibility/AccessibilityRenderObject.cpp:2191: Element* mapParent
= area->parentElement();
Why should we traverse the parent chain ? Is this expected behavior, i see this
code

HTMLImageElement* HTMLAreaElement::imageElement() const
{
    Node* mapElement = parentNode();
    if (!mapElement || !mapElement->hasTagName(mapTag))
        return 0;
    
    return static_cast<HTMLMapElement*>(mapElement)->imageElement();
}

[dmazzoni, 2013-06-08 23:06:32]

On 2013/06/08 22:44:39, inferno wrote:
> Why should we traverse the parent chain ?

The spec says <area> can be a descendant of <map>, it doesn't have to be a
direct child.

I tested it in Chrome and Firefox, and this works:

<map>
  <div>
    <area>
    <area>
  </div>
</map>

>i see this code
> 
> HTMLImageElement* HTMLAreaElement::imageElement() const
> {
>     Node* mapElement = parentNode();
>     if (!mapElement || !mapElement->hasTagName(mapTag))
>         return 0;
>     
>     return static_cast<HTMLMapElement*>(mapElement)->imageElement();
> }

Looks like a bug. Let's fix that too as a separate change.

[inferno, 2013-06-08 23:26:54]

On 2013/06/08 23:06:32, Dominic Mazzoni wrote:
> On 2013/06/08 22:44:39, inferno wrote:
> > Why should we traverse the parent chain ?
> 
> The spec says <area> can be a descendant of <map>, it doesn't have to be a
> direct child.
> 
> I tested it in Chrome and Firefox, and this works:
> 
> <map>
>   <div>
>     <area>
>     <area>
>   </div>
> </map>
> 
> >i see this code
> > 
> > HTMLImageElement* HTMLAreaElement::imageElement() const
> > {
> >     Node* mapElement = parentNode();
> >     if (!mapElement || !mapElement->hasTagName(mapTag))
> >         return 0;
> >     
> >     return static_cast<HTMLMapElement*>(mapElement)->imageElement();
> > }
> 
> Looks like a bug. Let's fix that too as a separate change.

ok.

[commit-bot: I haz the power, 2013-06-08 23:27:04]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dmazzoni@chromium.org/16647009/1

[commit-bot: I haz the power, 2013-06-09 00:36:42]

Retried try job too often on blink_presubmit for step(s) presubmit
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=blink_pres...

[commit-bot: I haz the power, 2013-06-09 06:07:03]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dmazzoni@chromium.org/16647009/1

[commit-bot: I haz the power, 2013-06-09 07:15:07]

Retried try job too often on blink_presubmit for step(s) presubmit
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=blink_pres...

[commit-bot: I haz the power, 2013-06-09 07:33:21]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dmazzoni@chromium.org/16647009/1

[commit-bot: I haz the power, 2013-06-09 08:31:49]

Retried try job too often on linux_layout_rel for step(s) webkit_tests
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=linux_layo...

[commit-bot: I haz the power, 2013-06-09 19:38:18]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/dmazzoni@chromium.org/16647009/1

[commit-bot: I haz the power, 2013-06-09 20:10:07]

Change committed as 152090