commit 04fcd9c130c9211216da5a1418f0e7a26c3389a2
author dmazzoni@google.com <dmazzoni@google.com@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Tue May 22 15:24:33 2012
committer dmazzoni@google.com <dmazzoni@google.com@bbb929c8-8fbe-4397-9dbb-9b2b20218538> Tue May 22 15:24:33 2012
tree 555e43c5d80d4f75b14422bfcd851b8ec4be2dc3
parent e751b2a9926357991442c53ce89fdf23ea6864a3

Chromium AX: Crash when menulist adds selected option via document.write
https://bugs.webkit.org/show_bug.cgi?id=87028

Reviewed by Chris Fleizach.

Source/WebCore:

Test: platform/chromium/accessibility/add-to-menu-list-crashes.html

* rendering/RenderMenuList.cpp:
(WebCore::RenderMenuList::addChild):

LayoutTests:

* platform/chromium/accessibility/add-to-menu-list-crashes-expected.txt: Added.
* platform/chromium/accessibility/add-to-menu-list-crashes.html: Added.


git-svn-id: svn://svn.chromium.org/blink/trunk@117976 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/WebCore/rendering/RenderMenuList.cpp

diff --git a/third_party/WebKit/Source/WebCore/rendering/RenderMenuList.cpp b/third_party/WebKit/Source/WebCore/rendering/RenderMenuList.cpp
index ae78af3..48146e2 100644
--- a/third_party/WebKit/Source/WebCore/rendering/RenderMenuList.cpp
+++ b/third_party/WebKit/Source/WebCore/rendering/RenderMenuList.cpp
@@ -119,6 +119,9 @@
     createInnerBlock();
     m_innerBlock->addChild(newChild, beforeChild);
     ASSERT(m_innerBlock == firstChild());
+
+    if (AXObjectCache::accessibilityEnabled())
+        document()->axObjectCache()->childrenChanged(this);
 }
 
 void RenderMenuList::removeChild(RenderObject* oldChild)