1 files changed, 32 insertions, 10 deletions
diff --git a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 8651a80..d51750a 100644
--- a/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -137,18 +137,40 @@ AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned colu
     if (column >= columnCount() || row >= rowCount())
         return 0;
     
-    AccessibilityObject* tableRow = m_rows[row].get();
-    if (!tableRow)
-        return 0;
+    int intRow = (int)row;
+    int intColumn = (int)column;
+
+    pair<int, int> columnRange;
+    pair<int, int> rowRange;
     
-    AccessibilityChildrenVector children = tableRow->children();
-    // in case this row had fewer columns than other rows
-    AccessibilityObject* tableCell = 0;
-    if (column >= children.size())
-        return 0;
+    // Iterate backwards through the rows in case the desired cell has a rowspan and exists
+    // in a previous row.
+    for (; intRow >= 0; --intRow) {
+        AccessibilityObject* tableRow = m_rows[intRow].get();
+        if (!tableRow)
+            continue;
+        
+        AccessibilityChildrenVector children = tableRow->children();
+        unsigned childrenLength = children.size();
+        
+        // Since some cells may have colspans, we have to check the actual range of each
+        // cell to determine which is the right one.
+        for (unsigned k = 0; k < childrenLength; ++k) {
+            AccessibilityObject* child = children[k].get();
+            if (!child->isTableCell()) 
+                continue;
+            
+            AccessibilityTableCell* tableCellChild = static_cast<AccessibilityTableCell*>(child);
+            tableCellChild->columnIndexRange(columnRange);
+            tableCellChild->rowIndexRange(rowRange);
+            
+            if ((intColumn >= columnRange.first && intColumn < (columnRange.first + columnRange.second))
+                && (intRow >= rowRange.first && intRow < (rowRange.first + rowRange.second)))
+                return tableCellChild;
+        }
+    }
 
-    tableCell = children[column].get();
-    return static_cast<AccessibilityTableCell*>(tableCell);
+    return 0;
 }
     
 } // namespace WebCore