diff options
Diffstat (limited to 'WebCore/accessibility/AccessibilityTableCell.cpp')
| -rw-r--r-- | WebCore/accessibility/AccessibilityTableCell.cpp | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/WebCore/accessibility/AccessibilityTableCell.cpp b/WebCore/accessibility/AccessibilityTableCell.cpp index 7fadb88..28e66ad 100644 --- a/WebCore/accessibility/AccessibilityTableCell.cpp +++ b/WebCore/accessibility/AccessibilityTableCell.cpp @@ -73,7 +73,12 @@ AccessibilityObject* AccessibilityTableCell::parentTable() const if (!m_renderer || !m_renderer->isTableCell()) return 0; - return axObjectCache()->getOrCreate(toRenderTableCell(m_renderer)->table()); + // Do not use getOrCreate. parentTable() can be called while the render tree is being modified + // by javascript, and creating a table element may try to access the render tree while in a bad state. + // By using only get() implies that the AXTable must be created before AXTableCells. This should + // always be the case when AT clients access a table. + // https://bugs.webkit.org/show_bug.cgi?id=42652 + return axObjectCache()->get(toRenderTableCell(m_renderer)->table()); } bool AccessibilityTableCell::isTableCell() const |