Fix crash when assuming that an AREA's parent must be a MAP.

Source/core/accessibility/AccessibilityRenderObject.cpp

Index: Source/core/accessibility/AccessibilityRenderObject.cpp
diff --git a/Source/core/accessibility/AccessibilityRenderObject.cpp b/Source/core/accessibility/AccessibilityRenderObject.cpp
index bc6328a4c76880b4c459bf5593f9f6ce1a571200..0c336f3dde56ef60079da43c08164206f08a2957 100644
--- a/Source/core/accessibility/AccessibilityRenderObject.cpp
+++ b/Source/core/accessibility/AccessibilityRenderObject.cpp
@@ -2188,7 +2188,12 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTM
     if (!area)
         return 0;
 
-    HTMLMapElement* map = static_cast<HTMLMapElement*>(area->parentNode());
+    Element* mapParent = area->parentElement();

[inferno, 2013/06/08 22:44:39]

Why should we traverse the parent chain ? Is this expected behavior, i see this
code

HTMLImageElement* HTMLAreaElement::imageElement() const
{
    Node* mapElement = parentNode();
    if (!mapElement || !mapElement->hasTagName(mapTag))
        return 0;
    
    return static_cast<HTMLMapElement*>(mapElement)->imageElement();
}

+    while (mapParent && !mapParent->hasTagName(mapTag))
+        mapParent = mapParent->parentElement();
+    if (!mapParent)
+        return 0;
+    HTMLMapElement* map = static_cast<HTMLMapElement*>(mapParent);
     AccessibilityObject* parent = accessibilityParentForImageMap(map);
     if (!parent)
         return 0;