Merge WebKit at r65072 : Initial merge by git.

Change-Id: Ibcf418498376b2660aacb7f8d46ea7085ef91585

16 files changed, 217 insertions, 165 deletions

diff --git a/WebCore/accessibility/AXObjectCache.cpp b/WebCore/accessibility/AXObjectCache.cpp
index 750c611..907bb15 100644
--- a/WebCore/accessibility/AXObjectCache.cpp
+++ b/WebCore/accessibility/AXObjectCache.cpp
@@ -59,8 +59,13 @@
 #endif
 #include "InputElement.h"
 #include "Page.h"
-#include "RenderObject.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+#include "RenderTable.h"
+#include "RenderTableCell.h"
+#include "RenderTableRow.h"
 #include "RenderProgress.h"
+#include "RenderSlider.h"
 #include "RenderView.h"
 
 #include <wtf/PassRefPtr.h>
@@ -160,80 +165,87 @@ AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
     
     return obj;
 }
-    
-bool AXObjectCache::nodeHasRole(Node* node, const AtomicString& role)
+
+// FIXME: This probably belongs on Node.
+// FIXME: This should take a const char*, but one caller passes nullAtom.
+bool nodeHasRole(Node* node, const String& role)
 {
     if (!node || !node->isElementNode())
         return false;
-    
+
     return equalIgnoringCase(static_cast<Element*>(node)->getAttribute(roleAttr), role);
 }
 
-AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
+static PassRefPtr<AccessibilityObject> createFromRenderer(RenderObject* renderer)
 {
-    if (!renderer)
-        return 0;
-    
-    AccessibilityObject* obj = get(renderer);
+    // FIXME: How could renderer->node() ever not be an Element?
+    Node* node = renderer->node();
+
+    // If the node is aria role="list" or the aria role is empty and its a
+    // ul/ol/dl type (it shouldn't be a list if aria says otherwise).
+    if (node && ((nodeHasRole(node, "list") || nodeHasRole(node, "directory"))
+                      || (nodeHasRole(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
+        return AccessibilityList::create(renderer);
+
+    // aria tables
+    if (nodeHasRole(node, "grid") || nodeHasRole(node, "treegrid"))
+        return AccessibilityARIAGrid::create(renderer);
+    if (nodeHasRole(node, "row"))
+        return AccessibilityARIAGridRow::create(renderer);
+    if (nodeHasRole(node, "gridcell") || nodeHasRole(node, "columnheader") || nodeHasRole(node, "rowheader"))
+        return AccessibilityARIAGridCell::create(renderer);
 
-    if (!obj) {
-        Node* node = renderer->node();
-        RefPtr<AccessibilityObject> newObj = 0;
-        if (renderer->isListBox())
-            newObj = AccessibilityListBox::create(renderer);
-        else if (renderer->isMenuList())
-            newObj = AccessibilityMenuList::create(renderer);
+#if ENABLE(VIDEO)
+    // media controls
+    if (node && node->isMediaControlElement())
+        return AccessibilityMediaControl::create(renderer);
+#endif
 
-        // If the node is aria role="list" or the aria role is empty and its a ul/ol/dl type (it shouldn't be a list if aria says otherwise). 
-        else if (node && ((nodeHasRole(node, "list") || nodeHasRole(node, "directory"))
-                          || (nodeHasRole(node, nullAtom) && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))))
-            newObj = AccessibilityList::create(renderer);
-        
-        // aria tables
-        else if (nodeHasRole(node, "grid") || nodeHasRole(node, "treegrid"))
-            newObj = AccessibilityARIAGrid::create(renderer);
-        else if (nodeHasRole(node, "row"))
-            newObj = AccessibilityARIAGridRow::create(renderer);
-        else if (nodeHasRole(node, "gridcell") || nodeHasRole(node, "columnheader") || nodeHasRole(node, "rowheader"))
-            newObj = AccessibilityARIAGridCell::create(renderer);
+    if (renderer->isBoxModelObject()) {
+        RenderBoxModelObject* cssBox = toRenderBoxModelObject(renderer);
+        if (cssBox->isListBox())
+            return AccessibilityListBox::create(toRenderListBox(cssBox));
+        if (cssBox->isMenuList())
+            return AccessibilityMenuList::create(toRenderMenuList(cssBox));
 
         // standard tables
-        else if (renderer->isTable())
-            newObj = AccessibilityTable::create(renderer);
-        else if (renderer->isTableRow())
-            newObj = AccessibilityTableRow::create(renderer);
-        else if (renderer->isTableCell())
-            newObj = AccessibilityTableCell::create(renderer);
-
-#if ENABLE(VIDEO)
-        // media controls
-        else if (renderer->node() && renderer->node()->isMediaControlElement())
-            newObj = AccessibilityMediaControl::create(renderer);
-#endif
+        if (cssBox->isTable())
+            return AccessibilityTable::create(toRenderTable(cssBox));
+        if (cssBox->isTableRow())
+            return AccessibilityTableRow::create(toRenderTableRow(cssBox));
+        if (cssBox->isTableCell())
+            return AccessibilityTableCell::create(toRenderTableCell(cssBox));
 
 #if ENABLE(PROGRESS_TAG)
         // progress bar
-        else if (renderer->isProgress())
-            newObj = AccessibilityProgressIndicator::create(toRenderProgress(renderer));
+        if (cssBox->isProgress())
+            return AccessibilityProgressIndicator::create(toRenderProgress(cssBox));
 #endif
 
         // input type=range
-        else if (renderer->isSlider())
-            newObj = AccessibilitySlider::create(renderer);
-
-        else
-            newObj = AccessibilityRenderObject::create(renderer);
-        
-        obj = newObj.get();
-        
-        getAXID(obj);
-        
-        m_renderObjectMapping.set(renderer, obj->axObjectID());
-        m_objects.set(obj->axObjectID(), obj);    
-        attachWrapper(obj);
+        if (cssBox->isSlider())
+            return AccessibilitySlider::create(toRenderSlider(cssBox));
     }
-    
-    return obj;
+
+    return AccessibilityRenderObject::create(renderer);
+}
+
+AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+
+    if (AccessibilityObject* obj = get(renderer))
+        return obj;
+
+    RefPtr<AccessibilityObject> newObj = createFromRenderer(renderer);
+
+    getAXID(newObj.get());
+
+    m_renderObjectMapping.set(renderer, newObj->axObjectID());
+    m_objects.set(newObj->axObjectID(), newObj);
+    attachWrapper(newObj.get());
+    return newObj.get();
 }
 
 AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
diff --git a/WebCore/accessibility/AXObjectCache.h b/WebCore/accessibility/AXObjectCache.h
index f18d08a..6da6842 100644
--- a/WebCore/accessibility/AXObjectCache.h
+++ b/WebCore/accessibility/AXObjectCache.h
@@ -29,6 +29,7 @@
 #include "AccessibilityObject.h"
 #include "Timer.h"
 #include <limits.h>
+#include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/RefPtr.h>
@@ -45,7 +46,6 @@ class HTMLAreaElement;
 class Node;
 class Page;
 class RenderObject;
-class String;
 class VisiblePosition;
 
 struct TextMarkerData {
@@ -124,8 +124,6 @@ public:
     void postNotification(RenderObject*, AXNotification, bool postToElement, PostType = PostAsynchronously);
     void postNotification(AccessibilityObject*, Document*, AXNotification, bool postToElement, PostType = PostAsynchronously);
 
-    bool nodeHasRole(Node*, const AtomicString& role);
-
 protected:
     void postPlatformNotification(AccessibilityObject*, AXNotification);
 
@@ -146,6 +144,8 @@ private:
     AXID getAXID(AccessibilityObject*);
 };
 
+bool nodeHasRole(Node*, const String& role);
+
 #if !HAVE(ACCESSIBILITY)
 inline void AXObjectCache::handleActiveDescendantChanged(RenderObject*) { }
 inline void AXObjectCache::handleAriaRoleChanged(RenderObject*) { }
diff --git a/WebCore/accessibility/AccessibilityARIAGrid.h b/WebCore/accessibility/AccessibilityARIAGrid.h
index 3511f0f..dc3c3ee 100644
--- a/WebCore/accessibility/AccessibilityARIAGrid.h
+++ b/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -30,10 +30,10 @@
 #define AccessibilityARIAGrid_h
 
 #include "AccessibilityTable.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
     
-class String;
 class AccessibilityTableCell;
 class AccessibilityTableHeaderContainer;
 
diff --git a/WebCore/accessibility/AccessibilityImageMapLink.cpp b/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 924ba21..9b77400 100644
--- a/WebCore/accessibility/AccessibilityImageMapLink.cpp
+++ b/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -33,18 +33,15 @@
 #include "AccessibilityRenderObject.h"
 #include "Document.h"
 #include "HTMLNames.h"
-#include "IntRect.h"
-#include "RenderObject.h"
-
-using namespace std;
+#include "RenderBoxModelObject.h"
 
 namespace WebCore {
     
 using namespace HTMLNames;
 
 AccessibilityImageMapLink::AccessibilityImageMapLink()
-    : m_areaElement(0), 
-      m_mapElement(0)
+    : m_areaElement(0)
+    , m_mapElement(0)
 {
 }
 
diff --git a/WebCore/accessibility/AccessibilityListBoxOption.h b/WebCore/accessibility/AccessibilityListBoxOption.h
index c4c9315..c500283 100644
--- a/WebCore/accessibility/AccessibilityListBoxOption.h
+++ b/WebCore/accessibility/AccessibilityListBoxOption.h
@@ -31,6 +31,7 @@
 
 #include "AccessibilityObject.h"
 #include "HTMLElement.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
 
@@ -38,7 +39,6 @@ class AccessibilityListBox;
 class Element;
 class HTMLElement;
 class HTMLSelectElement;
-class String;
     
 class AccessibilityListBoxOption : public AccessibilityObject {
 
diff --git a/WebCore/accessibility/AccessibilityMenuList.cpp b/WebCore/accessibility/AccessibilityMenuList.cpp
index 05cdf97..bde4cd4 100644
--- a/WebCore/accessibility/AccessibilityMenuList.cpp
+++ b/WebCore/accessibility/AccessibilityMenuList.cpp
@@ -32,10 +32,14 @@
 
 namespace WebCore {
 
-AccessibilityMenuList::AccessibilityMenuList(RenderObject* renderer)
+AccessibilityMenuList::AccessibilityMenuList(RenderMenuList* renderer)
     : AccessibilityRenderObject(renderer)
 {
-    ASSERT_ARG(renderer, renderer->isMenuList());
+}
+
+RenderMenuList* AccessibilityMenuList::renderer() const
+{
+    return toRenderMenuList(AccessibilityRenderObject::renderer());
 }
 
 bool AccessibilityMenuList::press() const
diff --git a/WebCore/accessibility/AccessibilityMenuList.h b/WebCore/accessibility/AccessibilityMenuList.h
index 376958f..4082f0a 100644
--- a/WebCore/accessibility/AccessibilityMenuList.h
+++ b/WebCore/accessibility/AccessibilityMenuList.h
@@ -33,16 +33,19 @@ namespace WebCore {
 class AccessibilityMenuList;
 class AccessibilityMenuListPopup;
 class HTMLOptionElement;
+class RenderMenuList;
 
 class AccessibilityMenuList : public AccessibilityRenderObject {
 public:
-    static PassRefPtr<AccessibilityMenuList> create(RenderObject* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
+    static PassRefPtr<AccessibilityMenuList> create(RenderMenuList* renderer) { return adoptRef(new AccessibilityMenuList(renderer)); }
 
     virtual bool isCollapsed() const;
     virtual bool press() const;
 
+    RenderMenuList* renderer() const;
+
 private:
-    AccessibilityMenuList(RenderObject*);
+    AccessibilityMenuList(RenderMenuList*);
 
     virtual bool isMenuList() const { return true; }
     virtual AccessibilityRole roleValue() const { return PopUpButtonRole; }
diff --git a/WebCore/accessibility/AccessibilityMenuListPopup.cpp b/WebCore/accessibility/AccessibilityMenuListPopup.cpp
index 48c2fab..515e02f 100644
--- a/WebCore/accessibility/AccessibilityMenuListPopup.cpp
+++ b/WebCore/accessibility/AccessibilityMenuListPopup.cpp
@@ -31,7 +31,7 @@
 #include "AccessibilityMenuListOption.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
-#include "RenderObject.h"
+#include "RenderMenuList.h"
 
 namespace WebCore {
 
diff --git a/WebCore/accessibility/AccessibilityObject.cpp b/WebCore/accessibility/AccessibilityObject.cpp
index b0ae86b..a6bb033 100644
--- a/WebCore/accessibility/AccessibilityObject.cpp
+++ b/WebCore/accessibility/AccessibilityObject.cpp
@@ -378,16 +378,15 @@ VisiblePositionRange AccessibilityObject::visiblePositionRangeForRange(const Pla
     // Gtk ATs need this for all text objects; not just text controls.
     if (!textLength) {
         Node* node = this->node();
-        if (node) {
-            RenderText* renderText = toRenderText(node->renderer());
-            if (renderText)
-                textLength = renderText->textLength();
-
-            // Get the text length from the elements under the
-            // accessibility object if not a RenderText object.
-            if (!textLength && allowsTextRanges())
-                textLength = textUnderElement().length();
+        RenderObject* renderer = node ? node->renderer() : 0;
+        if (renderer && renderer->isText()) {
+            RenderText* renderText = toRenderText(renderer);
+            textLength = renderText ? renderText->textLength() : 0;
         }
+        // Get the text length from the elements under the
+        // accessibility object if the value is still zero.
+        if (!textLength && allowsTextRanges())
+            textLength = textUnderElement().length();
     }
 #endif
     if (range.start + range.length > textLength)
@@ -417,14 +416,11 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
 // Finds a RenderListItem parent give a node.
 static RenderListItem* renderListItemContainerForNode(Node* node)
 {
-    for (Node* stringNode = node; stringNode; stringNode = stringNode->parent()) {
-        RenderObject* renderObject = stringNode->renderer();
-        if (!renderObject || !renderObject->isListItem())
-            continue;
-        
-        return toRenderListItem(renderObject);
+    for (; node; node = node->parent()) {
+        RenderBoxModelObject* renderer = node->renderBoxModelObject();
+        if (renderer && renderer->isListItem())
+            return toRenderListItem(renderer);
     }
-    
     return 0;
 }
     
@@ -970,6 +966,15 @@ AccessibilityRole AccessibilityObject::ariaRoleToWebCoreRole(const String& value
     return roleMap->get(value);
 }
 
+const AtomicString& AccessibilityObject::placeholderValue() const
+{
+    const AtomicString& placeholder = getAttribute(placeholderAttr);
+    if (!placeholder.isEmpty())
+        return placeholder;
+    
+    return nullAtom;
+}
+    
 bool AccessibilityObject::isInsideARIALiveRegion() const
 {
     if (supportsARIALiveRegion())
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index c517855..0e44d1b 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -34,6 +34,7 @@
 #include "Range.h"
 #include "VisiblePosition.h"
 #include "VisibleSelection.h"
+#include <wtf/Forward.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -87,7 +88,6 @@ class Node;
 class RenderObject;
 class RenderListItem;
 class VisibleSelection;
-class String;
 class Widget;
 
 typedef unsigned AXID;
@@ -428,6 +428,7 @@ public:
     virtual FrameView* documentFrameView() const;
     String language() const;
     virtual unsigned hierarchicalLevel() const { return 0; }
+    const AtomicString& placeholderValue() const;
     
     virtual void setFocused(bool) { }
     virtual void setSelectedText(const String&) { }
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index a5e1cc3..24c29d4 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -120,8 +120,19 @@ void AccessibilityRenderObject::detach()
     m_renderer = 0;    
 }
 
-static inline bool isInlineWithContinuation(RenderObject* renderer)
+RenderBoxModelObject* AccessibilityRenderObject::renderBoxModelObject() const
 {
+    if (!m_renderer || !m_renderer->isBoxModelObject())
+        return 0;
+    return toRenderBoxModelObject(m_renderer);
+}
+
+static inline bool isInlineWithContinuation(RenderObject* object)
+{
+    if (!object->isBoxModelObject())
+        return false;
+
+    RenderBoxModelObject* renderer = toRenderBoxModelObject(object);
     if (!renderer->isRenderInline())
         return false;
 
@@ -429,7 +440,7 @@ bool AccessibilityRenderObject::isTextControl() const
 
 bool AccessibilityRenderObject::isNativeImage() const
 {
-    return m_renderer->isImage();
+    return m_renderer->isBoxModelObject() && toRenderBoxModelObject(m_renderer)->isImage();
 }    
     
 bool AccessibilityRenderObject::isImage() const
@@ -439,12 +450,12 @@ bool AccessibilityRenderObject::isImage() const
 
 bool AccessibilityRenderObject::isAttachment() const
 {
-    if (!m_renderer)
+    RenderBoxModelObject* renderer = renderBoxModelObject();
+    if (!renderer)
         return false;
-    
     // Widgets are the replaced elements that we represent to AX as attachments
-    bool isWidget = m_renderer && m_renderer->isWidget();
-    ASSERT(!isWidget || (m_renderer->isReplaced() && !isImage()));
+    bool isWidget = renderer->isWidget();
+    ASSERT(!isWidget || (renderer->isReplaced() && !isImage()));
     return isWidget && ariaRoleAttribute() == UnknownRole;
 }
 
@@ -603,7 +614,7 @@ bool AccessibilityRenderObject::isMultiSelectable() const
     if (equalIgnoringCase(ariaMultiSelectable, "false"))
         return false;
     
-    if (!m_renderer->isListBox())
+    if (!m_renderer->isBoxModelObject() || !toRenderBoxModelObject(m_renderer)->isListBox())
         return false;
     return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
 }
@@ -628,11 +639,14 @@ bool AccessibilityRenderObject::isReadOnly() const
         return !frame->isContentEditable();
     }
 
-    if (m_renderer->isTextField())
-        return static_cast<HTMLInputElement*>(m_renderer->node())->readOnly();
-    if (m_renderer->isTextArea())
-        return static_cast<HTMLTextAreaElement*>(m_renderer->node())->readOnly();
-    
+    if (m_renderer->isBoxModelObject()) {
+        RenderBoxModelObject* box = toRenderBoxModelObject(m_renderer);
+        if (box->isTextField())
+            return static_cast<HTMLInputElement*>(box->node())->readOnly();
+        if (box->isTextArea())
+            return static_cast<HTMLTextAreaElement*>(box->node())->readOnly();
+    }
+
     return !m_renderer->node() || !m_renderer->node()->isContentEditable();
 }
 
@@ -699,10 +713,10 @@ bool AccessibilityRenderObject::isControl() const
 
 bool AccessibilityRenderObject::isFieldset() const
 {
-    if (!m_renderer)
+    RenderBoxModelObject* renderer = renderBoxModelObject();
+    if (!renderer)
         return false;
-    
-    return m_renderer->isFieldset();
+    return renderer->isFieldset();
 }
   
 bool AccessibilityRenderObject::isGroup() const
@@ -789,7 +803,7 @@ Element* AccessibilityRenderObject::actionElement() const
         } else if (node->hasTagName(buttonTag))
             return static_cast<Element*>(node);
     }
-            
+
     if (isFileUploadButton())
         return static_cast<Element*>(m_renderer->node());
             
@@ -799,7 +813,7 @@ Element* AccessibilityRenderObject::actionElement() const
     if (isImageButton())
         return static_cast<Element*>(m_renderer->node());
     
-    if (m_renderer->isMenuList())
+    if (m_renderer->isBoxModelObject() && toRenderBoxModelObject(m_renderer)->isMenuList())
         return static_cast<Element*>(m_renderer->node());
 
     AccessibilityRole role = roleValue();
@@ -1049,7 +1063,9 @@ String AccessibilityRenderObject::stringValue() const
 {
     if (!m_renderer || isPasswordField())
         return String();
-    
+
+    RenderBoxModelObject* cssBox = renderBoxModelObject();
+
     if (ariaRoleAttribute() == StaticTextRole) {
         String staticText = text();
         if (!staticText.length())
@@ -1060,7 +1076,7 @@ String AccessibilityRenderObject::stringValue() const
     if (m_renderer->isText())
         return textUnderElement();
     
-    if (m_renderer->isMenuList()) {
+    if (cssBox && cssBox->isMenuList()) {
         // RenderMenuList will go straight to the text() of its selected item.
         // This has to be overriden in the case where the selected item has an aria label
         SelectElement* selectNode = toSelectElement(static_cast<Element*>(m_renderer->node()));
@@ -1082,7 +1098,7 @@ String AccessibilityRenderObject::stringValue() const
     if (m_renderer->isListMarker())
         return toRenderListMarker(m_renderer)->text();
     
-    if (m_renderer->isRenderButton())
+    if (cssBox && cssBox->isRenderButton())
         return toRenderButton(m_renderer)->text();
 
     if (isWebArea()) {
@@ -1256,10 +1272,6 @@ String AccessibilityRenderObject::title() const
         HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
         if (label && !titleUIElement())
             return label->innerText();
-        
-        const AtomicString& placeholder = getAttribute(placeholderAttr);
-        if (!placeholder.isEmpty())
-            return placeholder;
     }
     
     if (roleValue() == ButtonRole
@@ -1701,13 +1713,13 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     // An ARIA tree can only have tree items and static text as children.
     if (!isAllowedChildOfTree())
         return true;
-    
+
     // ignore popup menu items because AppKit does
     for (RenderObject* parent = m_renderer->parent(); parent; parent = parent->parent()) {
-        if (parent->isMenuList())
+        if (parent->isBoxModelObject() && toRenderBoxModelObject(parent)->isMenuList())
             return true;
     }
-    
+
     // find out if this element is inside of a label element.
     // if so, it may be ignored because it's the label for a checkbox or radio button
     AccessibilityObject* controlObject = correspondingControlForLabelElement();
@@ -2182,20 +2194,24 @@ void AccessibilityRenderObject::setSelectedRows(AccessibilityChildrenVector& sel
     
 void AccessibilityRenderObject::setValue(const String& string)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->node() || !m_renderer->node()->isElementNode())
         return;
-    
+    Element* element = static_cast<Element*>(m_renderer->node());
+
+    if (roleValue() == SliderRole)
+        element->setAttribute(aria_valuenowAttr, string);
+
+    if (!m_renderer->isBoxModelObject())
+        return;
+    RenderBoxModelObject* renderer = toRenderBoxModelObject(m_renderer);
+
     // FIXME: Do we want to do anything here for ARIA textboxes?
-    if (m_renderer->isTextField()) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
-        input->setValue(string);
-    } else if (m_renderer->isTextArea()) {
-        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
-        textArea->setValue(string);
-    } else if (roleValue() == SliderRole) {
-        Node* element = m_renderer->node();
-        if (element && element->isElementNode())
-            static_cast<Element*>(element)->setAttribute(aria_valuenowAttr, string);
+    if (renderer->isTextField()) {
+        // FIXME: This is not safe!  Other elements could have a TextField renderer.
+        static_cast<HTMLInputElement*>(element)->setValue(string);
+    } else if (renderer->isTextArea()) {
+        // FIXME: This is not safe!  Other elements could have a TextArea renderer.
+        static_cast<HTMLTextAreaElement*>(element)->setValue(string);
     }
 }
 
@@ -2255,7 +2271,7 @@ FrameView* AccessibilityRenderObject::topDocumentFrameView() const
 
 Widget* AccessibilityRenderObject::widget() const
 {
-    if (!m_renderer->isWidget())
+    if (!m_renderer->isBoxModelObject() || !toRenderBoxModelObject(m_renderer)->isWidget())
         return 0;
     return toRenderWidget(m_renderer)->widget();
 }
@@ -2516,12 +2532,12 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
             return VisiblePosition();
         
         pointResult = result.localPoint();
-        
+
         // done if hit something other than a widget
-        RenderObject* renderer = innerNode->renderer();
+        RenderBoxModelObject* renderer = innerNode->renderBoxModelObject();
         if (!renderer->isWidget())
             break;
-        
+
         // descend into widget (FRAME, IFRAME, OBJECT...)
         Widget* widget = toRenderWidget(renderer)->widget();
         if (!widget || !widget->isFrameView())
@@ -2706,13 +2722,13 @@ AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const Int
     
     AccessibilityObject* result = obj->document()->axObjectCache()->getOrCreate(obj);
 
-    if (obj->isListBox()) {
+    if (obj->isBoxModelObject() && toRenderBoxModelObject(obj)->isListBox()) {
         // Make sure the children are initialized so that hit testing finds the right element.
         AccessibilityListBox* listBox = static_cast<AccessibilityListBox*>(result);
         listBox->updateChildrenIfNecessary();
         return listBox->doAccessibilityHitTest(point);
     }
-        
+
     if (result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
         AccessibilityObject* controlObject = result->correspondingControlForLabelElement();
@@ -2870,13 +2886,12 @@ bool AccessibilityRenderObject::renderObjectIsObservable(RenderObject* renderer)
         return true;
     
     // AX clients will listen for AXSelectedChildrenChanged on listboxes.
-    AXObjectCache* cache = axObjectCache();
     Node* node = renderer->node();
-    if (renderer->isListBox() || cache->nodeHasRole(node, "listbox"))
+    if (nodeHasRole(node, "listbox") || (renderer->isBoxModelObject() && toRenderBoxModelObject(renderer)->isListBox()))
         return true;
-    
+
     // Textboxes should send out notifications.
-    if (cache->nodeHasRole(node, "textbox"))
+    if (nodeHasRole(node, "textbox"))
         return true;
     
     return false;
@@ -2950,13 +2965,15 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole != UnknownRole)
         return ariaRole;
-    
+
+    RenderBoxModelObject* cssBox = renderBoxModelObject();
+
     if (node && node->isLink()) {
-        if (m_renderer->isImage())
+        if (cssBox && cssBox->isImage())
             return ImageMapRole;
         return WebCoreLinkRole;
     }
-    if (m_renderer->isListItem())
+    if (cssBox && cssBox->isListItem())
         return ListItemRole;
     if (m_renderer->isListMarker())
         return ListMarkerRole;
@@ -2964,23 +2981,23 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
         return ButtonRole;
     if (m_renderer->isText())
         return StaticTextRole;
-    if (m_renderer->isImage()) {
+    if (cssBox && cssBox->isImage()) {
         if (node && node->hasTagName(inputTag))
             return ButtonRole;
         return ImageRole;
     }
     if (node && node->hasTagName(canvasTag))
         return ImageRole;
-    
-    if (m_renderer->isRenderView())
+
+    if (cssBox && cssBox->isRenderView())
         return WebAreaRole;
     
-    if (m_renderer->isTextField())
+    if (cssBox && cssBox->isTextField())
         return TextFieldRole;
     
-    if (m_renderer->isTextArea())
+    if (cssBox && cssBox->isTextArea())
         return TextAreaRole;
-    
+
     if (node && node->hasTagName(inputTag)) {
         HTMLInputElement* input = static_cast<HTMLInputElement*>(node);
         if (input->inputType() == HTMLInputElement::CHECKBOX)
@@ -2997,7 +3014,7 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (isFileUploadButton())
         return ButtonRole;
     
-    if (m_renderer->isMenuList())
+    if (cssBox && cssBox->isMenuList())
         return PopUpButtonRole;
     
     if (headingLevel())
@@ -3287,8 +3304,9 @@ void AccessibilityRenderObject::addChildren()
     }
     
     // for a RenderImage, add the <area> elements as individual accessibility objects
-    if (m_renderer->isRenderImage()) {
-        HTMLMapElement* map = toRenderImage(m_renderer)->imageMap();
+    RenderBoxModelObject* cssBox = renderBoxModelObject();
+    if (cssBox && cssBox->isRenderImage()) {
+        HTMLMapElement* map = toRenderImage(cssBox)->imageMap();
         if (map) {
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
@@ -3605,7 +3623,7 @@ static AccessibilityRole msaaRoleForRenderer(const RenderObject* renderer)
     if (renderer->isText())
         return EditableTextRole;
 
-    if (renderer->isListItem())
+    if (renderer->isBoxModelObject() && toRenderBoxModelObject(renderer)->isListItem())
         return ListItemRole;
 
     return UnknownRole;
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index c05bc2d..cefaa94 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -1,3 +1,4 @@
+
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
  *
@@ -30,7 +31,7 @@
 #define AccessibilityRenderObject_h
 
 #include "AccessibilityObject.h"
-#include "RenderObject.h"
+#include <wtf/Forward.h>
 
 namespace WebCore {
     
@@ -52,7 +53,6 @@ class RenderListBox;
 class RenderTextControl;
 class RenderView;
 class VisibleSelection;
-class String;
 class Widget;
     
 class AccessibilityRenderObject : public AccessibilityObject {
@@ -165,6 +165,7 @@ public:
     
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
     RenderObject* renderer() const { return m_renderer; }
+    RenderBoxModelObject* renderBoxModelObject() const;
     virtual Node* node() const;
 
     RenderView* topRenderer() const;
diff --git a/WebCore/accessibility/AccessibilityTable.cpp b/WebCore/accessibility/AccessibilityTable.cpp
index 04ecac3..7f7b6f2 100644
--- a/WebCore/accessibility/AccessibilityTable.cpp
+++ b/WebCore/accessibility/AccessibilityTable.cpp
@@ -43,8 +43,6 @@
 #include "RenderTableCell.h"
 #include "RenderTableSection.h"
 
-using namespace std;
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -75,7 +73,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     // <table> should be exposed as an AXTable. The goal
     // is to only show "data" tables
     
-    if (!m_renderer || !m_renderer->isTable())
+    if (!renderer())
         return false;
     
     // if the developer assigned an aria role to this, then we shouldn't 
@@ -196,7 +194,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             // For the first 5 rows, cache the background color so we can check if this table has zebra-striped rows.
             if (row < 5 && row == alternatingRowColorCount) {
                 RenderObject* renderRow = cell->parent();
-                if (!renderRow || !renderRow->isTableRow())
+                if (!renderRow || !renderRow->isBoxModelObject() || !toRenderBoxModelObject(renderRow)->isTableRow())
                     continue;
                 RenderStyle* rowRenderStyle = renderRow->style();
                 if (!rowRenderStyle)
diff --git a/WebCore/accessibility/AccessibilityTable.h b/WebCore/accessibility/AccessibilityTable.h
index 42edf2a..2ee5812 100644
--- a/WebCore/accessibility/AccessibilityTable.h
+++ b/WebCore/accessibility/AccessibilityTable.h
@@ -30,6 +30,7 @@
 #define AccessibilityTable_h
 
 #include "AccessibilityRenderObject.h"
+#include <wtf/Forward.h>
 
 #if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
 #define ACCESSIBILITY_TABLES 0
@@ -39,7 +40,6 @@
 
 namespace WebCore {
 
-class String;
 class AccessibilityTableCell;
 class AccessibilityTableHeaderContainer;
     
@@ -50,7 +50,7 @@ protected:
 public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
     virtual ~AccessibilityTable();
-    
+
     virtual bool isDataTable() const;
     virtual AccessibilityRole roleValue() const;
     virtual bool isAriaTable() const { return false; }
@@ -78,17 +78,17 @@ public:
 
     // an object that contains, as children, all the objects that act as headers
     AccessibilityObject* headerContainer();
-    
-protected:    
+
+protected:
     AccessibilityChildrenVector m_rows;
     AccessibilityChildrenVector m_columns;
-    
+
     AccessibilityTableHeaderContainer* m_headerContainer;
     mutable bool m_isAccessibilityTable;
-    
+
     bool isTableExposableThroughAccessibility();
 };
-    
+
 } // namespace WebCore 
 
 #endif // AccessibilityTable_h
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 716188a..fd5d6bb 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -160,6 +160,11 @@ static const gchar* webkit_accessible_get_name(AtkObject* object)
             if (ATK_IS_TEXT(atkObject))
                 return webkit_accessible_text_get_text(ATK_TEXT(atkObject), 0, -1);
         }
+
+        // Try text under the node
+        String textUnder = renderObject->textUnderElement();
+        if (textUnder.length())
+            return returnString(textUnder);
     }
 
     if (renderObject->isImage() || renderObject->isInputImage()) {
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index 94d2be3..9595e25 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -157,6 +157,10 @@ using namespace std;
 #define NSAccessibilityHasPopupAttribute @"AXHasPopup"
 #endif
 
+#ifndef NSAccessibilityPlaceholderValueAttribute
+#define NSAccessibilityPlaceholderValueAttribute @"AXPlaceholderValue"
+#endif
+
 #ifdef BUILDING_ON_TIGER
 typedef unsigned NSUInteger;
 #define NSAccessibilityValueDescriptionAttribute @"AXValueDescription"
@@ -731,6 +735,7 @@ static WebCoreTextMarkerRange* textMarkerRangeFromVisiblePositions(VisiblePositi
         [tempArray addObject:NSAccessibilityTitleUIElementAttribute];
         [tempArray addObject:NSAccessibilityAccessKeyAttribute];
         [tempArray addObject:NSAccessibilityRequiredAttribute];
+        [tempArray addObject:NSAccessibilityPlaceholderValueAttribute];
         textAttrs = [[NSArray alloc] initWithArray:tempArray];
         [tempArray release];
     }
@@ -1859,6 +1864,9 @@ static NSString* roleValueToNSString(AccessibilityRole value)
         return dropEffectsArray;
     }
     
+    if ([attributeName isEqualToString:NSAccessibilityPlaceholderValueAttribute])
+        return m_object->placeholderValue();
+    
     if ([attributeName isEqualToString:NSAccessibilityHasPopupAttribute])
         return [NSNumber numberWithBool:m_object->ariaHasPopup()];