Fix crash when assuming that an AREA's parent must be a MAP.

Source/core/accessibility/AccessibilityRenderObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 2170 matching lines @@
 
     // The element we find may not be accessible, so find the first accessible object.
     return firstAccessibleObjectFromNode(linkedNode);
 }
 
 AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTMLAreaElement* area, const IntPoint& point) const
 {
     if (!area)
         return 0;
 
-    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parentNode());
+    Element* mapParent = area->parentElement();

[inferno, 2013/06/08 22:44:39]

Why should we traverse the parent chain ? Is this expected behavior, i see this
code

HTMLImageElement* HTMLAreaElement::imageElement() const
{
    Node* mapElement = parentNode();
    if (!mapElement || !mapElement->hasTagName(mapTag))
        return 0;
    
    return static_cast<HTMLMapElement*>(mapElement)->imageElement();
}

+    while (mapParent && !mapParent->hasTagName(mapTag))
+        mapParent = mapParent->parentElement();
+    if (!mapParent)
+        return 0;
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(mapParent);
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;
 
     AccessibilityObject::AccessibilityChildrenVector children = parent->children();
 
     unsigned count = children.size();
     for (unsigned k = 0; k < count; ++k) {
         if (children[k]->elementRect().contains(point))
             return children[k].get();
@@ skipping 402 matching lines @@
         if (label && label->renderer()) {
             LayoutRect labelRect = axObjectCache()->getOrCreate(label)->elementRect();
             result.unite(labelRect);
         }
     }
 
     return result;
 }
 
 } // namespace WebCore