<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[166194] trunk</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/166194">166194</a></dd>
<dt>Author</dt> <dd>cfleizach@apple.com</dd>
<dt>Date</dt> <dd>2014-03-24 14:26:25 -0700 (Mon, 24 Mar 2014)</dd>
</dl>

<h3>Log Message</h3>
<pre>Regression: AX: Don't expose role or notifications for invalid menus
https://bugs.webkit.org/show_bug.cgi?id=129814

Reviewed by Mario Sanchez Prada.

Source/WebCore: 

If a role=menu has no menuitem children, it should not be a menu.
This was a bit tricky to implement since we need to update the role after the children are created,
but it means we have to be a bit more aggressive about when to updateChildren, so that the role
is known to be valid.

Test: platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html

* accessibility/AXObjectCache.cpp:
(WebCore::AXObjectCache::notificationPostTimerFired):
* accessibility/AccessibilityRenderObject.cpp:
(WebCore::AccessibilityRenderObject::updateRoleAfterChildrenCreation):
(WebCore::AccessibilityRenderObject::addChildren):
* accessibility/AccessibilityRenderObject.h:
* accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
(-[WebAccessibilityObjectWrapperBase updateObjectBackingStore]):

LayoutTests: 

* accessibility/table-with-aria-role.html:
     Modify test so that tests only what we want (that the role is correct).
     No longer use role=menu on the table, since the table won't have menuitems and won't be a valid menu.
* platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt: Added.
* platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html: Added.
* platform/mac/accessibility/table-with-aria-role-expected.txt:</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsChangeLog">trunk/LayoutTests/ChangeLog</a></li>
<li><a href="#trunkLayoutTestsaccessibilitytablewithariarolehtml">trunk/LayoutTests/accessibility/table-with-aria-role.html</a></li>
<li><a href="#trunkSourceWebCoreChangeLog">trunk/Source/WebCore/ChangeLog</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAXObjectCachecpp">trunk/Source/WebCore/accessibility/AXObjectCache.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp</a></li>
<li><a href="#trunkSourceWebCoreaccessibilityAccessibilityRenderObjecth">trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsaccessibilitytablewithariaroleexpectedtxt">trunk/LayoutTests/accessibility/table-with-aria-role-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacaccessibilityinvalidmenuroledoesnotsendnotificationexpectedtxt">trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt</a></li>
<li><a href="#trunkLayoutTestsplatformmacaccessibilityinvalidmenuroledoesnotsendnotificationhtml">trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html</a></li>
</ul>

<h3>Removed Paths</h3>
<ul>
<li><a href="#trunkLayoutTestsplatformmacaccessibilitytablewithariaroleexpectedtxt">trunk/LayoutTests/platform/mac/accessibility/table-with-aria-role-expected.txt</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/ChangeLog (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/ChangeLog        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/LayoutTests/ChangeLog        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -1,3 +1,17 @@
</span><ins>+2014-03-18  Chris Fleizach  &lt;cfleizach@apple.com&gt;
+
+        Regression: AX: Don't expose role or notifications for invalid menus
+        https://bugs.webkit.org/show_bug.cgi?id=129814
+
+        Reviewed by Mario Sanchez Prada.
+
+        * accessibility/table-with-aria-role.html:
+             Modify test so that tests only what we want (that the role is correct).
+             No longer use role=menu on the table, since the table won't have menuitems and won't be a valid menu.
+        * platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt: Added.
+        * platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html: Added.
+        * platform/mac/accessibility/table-with-aria-role-expected.txt:
+
</ins><span class="cx"> 2014-03-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         &lt;hr&gt; should expose AXRole/AXSubrole, etc
</span></span></pre></div>
<a id="trunkLayoutTestsaccessibilitytablewithariaroleexpectedtxtfromrev166174trunkLayoutTestsplatformmacaccessibilitytablewithariaroleexpectedtxt"></a>
<div class="copfile"><h4>Copied: trunk/LayoutTests/accessibility/table-with-aria-role-expected.txt (from rev 166174, trunk/LayoutTests/platform/mac/accessibility/table-with-aria-role-expected.txt) (0 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/accessibility/table-with-aria-role-expected.txt                                (rev 0)
+++ trunk/LayoutTests/accessibility/table-with-aria-role-expected.txt        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -0,0 +1,6 @@
</span><ins>+Table1 should not have a table role because it's a button: AXRole: AXButton
+Table2 should not have a table role because it's a group: AXRole: AXGroup
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsaccessibilitytablewithariarolehtml"></a>
<div class="modfile"><h4>Modified: trunk/LayoutTests/accessibility/table-with-aria-role.html (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/accessibility/table-with-aria-role.html        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/LayoutTests/accessibility/table-with-aria-role.html        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -1,28 +1,33 @@
</span><span class="cx"> &lt;html&gt;
</span><ins>+&lt;script src=&quot;../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;script&gt;
</span><span class="cx">     if (window.testRunner)
</span><span class="cx">         testRunner.dumpAsText();
</span><span class="cx"> &lt;/script&gt;
</span><span class="cx"> &lt;body id=&quot;body&quot;&gt;
</span><span class="cx"> 
</span><del>-    &lt;table border=1 role=&quot;button&quot;&gt;
</del><ins>+&lt;div id=&quot;content&quot;&gt;
+    &lt;table border=1 role=&quot;button&quot; id='table1'&gt;
</ins><span class="cx">        &lt;tr&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;/tr&gt;
</span><span class="cx">        &lt;tr&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;/tr&gt;
</span><span class="cx">     &lt;/table&gt;
</span><span class="cx"> 
</span><del>-    &lt;table border=1 role=&quot;menu&quot;&gt;
</del><ins>+    &lt;table border=1 role=&quot;group&quot; id='table2'&gt;
</ins><span class="cx">        &lt;tr&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;/tr&gt;
</span><span class="cx">        &lt;tr&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;td&gt;test&lt;/td&gt;&lt;/tr&gt;
</span><span class="cx">     &lt;/table&gt;
</span><ins>+&lt;/div&gt;
</ins><span class="cx"> 
</span><span class="cx">     &lt;div id=&quot;result&quot;&gt;&lt;/div&gt;
</span><span class="cx">     
</span><span class="cx">     &lt;script&gt;
</span><span class="cx">         if (window.accessibilityController) {
</span><del>-            var body = document.getElementById(&quot;body&quot;);
-            body.focus();
-            result.innerText += accessibilityController.focusedElement.attributesOfChildren();
</del><ins>+            debug(&quot;Table1 should not have a table role because it's a button: &quot; + accessibilityController.accessibleElementById('table1').role);
+            debug(&quot;Table2 should not have a table role because it's a group: &quot; + accessibilityController.accessibleElementById('table2').role);
+
+            document.getElementById(&quot;content&quot;).style.display = &quot;none&quot;;
</ins><span class="cx">         }
</span><span class="cx">     &lt;/script&gt;
</span><ins>+&lt;script src=&quot;../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
</ins><span class="cx"> &lt;/body&gt;
</span><span class="cx"> &lt;/html&gt;
</span></span></pre></div>
<a id="trunkLayoutTestsplatformmacaccessibilityinvalidmenuroledoesnotsendnotificationexpectedtxt"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt (0 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt                                (rev 0)
+++ trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification-expected.txt        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -0,0 +1,10 @@
</span><ins>+This tests that the AXMenuOpened notification does not get fired for a menu that is invalid (does not have a menu item child).
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+The item should not have a menu role: AXRole: AXGroup
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacaccessibilityinvalidmenuroledoesnotsendnotificationhtml"></a>
<div class="addfile"><h4>Added: trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html (0 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html                                (rev 0)
+++ trunk/LayoutTests/platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -0,0 +1,58 @@
</span><ins>+&lt;!DOCTYPE HTML PUBLIC &quot;-//IETF//DTD HTML//EN&quot;&gt;
+&lt;html&gt;
+&lt;head&gt;
+&lt;script src=&quot;../../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;/head&gt;
+&lt;body id=&quot;body&quot;&gt;
+
+&lt;div id=&quot;content&quot;&gt;
+&lt;div id=&quot;menu1&quot; role=&quot;menu&quot; hidden&gt;
+&lt;a href=&quot;#&quot;&gt;item&lt;/a&gt;
+&lt;/div&gt;
+&lt;/div&gt;
+
+
+&lt;p id=&quot;description&quot;&gt;&lt;/p&gt;
+&lt;div id=&quot;console&quot;&gt;&lt;/div&gt;
+
+&lt;script&gt;
+
+    description(&quot;This tests that the AXMenuOpened notification does not get fired for a menu that is invalid (does not have a menu item child).&quot;);
+
+    function showMenu(menu) {
+        document.getElementById(&quot;menu1&quot;).removeAttribute(&quot;hidden&quot;);
+        debug(&quot;The item should not have a menu role: &quot; + accessibilityController.accessibleElementById('menu1').role);
+    }
+
+    var notification = 0;
+    var element = 0;
+    function ariaCallback(element, notification) {
+        if (notification == &quot;AXMenuOpened&quot;) {
+           debug(&quot;FAIL Received menu opened notification: &quot; + notification);
+        }
+    }
+
+    function endTest() {
+       document.getElementById(&quot;content&quot;).style.display = 'none';
+       accessibilityController.removeNotificationListener();
+       finishJSTest();
+    }
+
+    window.jsTestIsAsync = true;
+    if (window.accessibilityController) {
+        var addedNotification = accessibilityController.addNotificationListener(ariaCallback);
+
+        // Make sure AX is enabled by accessing root element.
+        accessibilityController.rootElement;
+
+        setTimeout(&quot;showMenu();&quot;, 1);
+        // We should not actually get this notification, so end the test after a short time when we 'might' have gotten the notification.
+        setTimeout(&quot;endTest();&quot;, 100);
+    }
+    successfullyParsed = true;
+
+&lt;/script&gt;
+
+&lt;script src=&quot;../../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="trunkLayoutTestsplatformmacaccessibilitytablewithariaroleexpectedtxt"></a>
<div class="delfile"><h4>Deleted: trunk/LayoutTests/platform/mac/accessibility/table-with-aria-role-expected.txt (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/LayoutTests/platform/mac/accessibility/table-with-aria-role-expected.txt        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/LayoutTests/platform/mac/accessibility/table-with-aria-role-expected.txt        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -1,45 +0,0 @@
</span><del>-test        test        test
-test        test        test
-test        test        test
-test        test        test
-AXRole: AXButton
-AXSubrole: (null)
-AXRoleDescription: button
-AXChildren: &lt;array of size 0&gt;
-AXHelp: 
-AXParent: &lt;AXButton: 'test test test test test test'&gt;
-AXSize: NSSize: {85, 52}
-AXTitle: test test test test test test
-AXDescription: 
-AXFocused: 0
-AXEnabled: 1
-AXWindow: &lt;AXButton: 'test test test test test test'&gt;
-AXSelectedTextMarkerRange: (null)
-AXStartTextMarker: &lt;AXButton: 'test test test test test test'&gt;
-AXEndTextMarker: &lt;AXButton: 'test test test test test test'&gt;
-AXVisited: 0
-AXLinkedUIElements: (null)
-AXSelected: 0
-AXBlockQuoteLevel: 0
-AXTopLevelUIElement: &lt;AXButton: 'test test test test test test'&gt;
-AXLanguage: 
-AXDOMIdentifier: 
-AXDOMClassList: &lt;array of size 0&gt;
-AXTitleUIElement: (null)
-AXAccessKey: (null)
-AXElementBusy: 0
-
-------------
-AXRole: AXMenu
-AXRoleDescription: menu
-AXChildren: &lt;array of size 6&gt;
-AXParent: &lt;AXMenu&gt;
-AXEnabled: 1
-AXSize: NSSize: {85, 52}
-AXSelectedChildren: (null)
-AXVisibleChildren: (null)
-AXTitleUIElement: (null)
-AXElementBusy: 0
-
-------------
-
</del></span></pre></div>
<a id="trunkSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/ChangeLog (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/ChangeLog        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/Source/WebCore/ChangeLog        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2014-03-24  Chris Fleizach  &lt;cfleizach@apple.com&gt;
+
+        Regression: AX: Don't expose role or notifications for invalid menus
+        https://bugs.webkit.org/show_bug.cgi?id=129814
+
+        Reviewed by Mario Sanchez Prada.
+
+        If a role=menu has no menuitem children, it should not be a menu.
+        This was a bit tricky to implement since we need to update the role after the children are created,
+        but it means we have to be a bit more aggressive about when to updateChildren, so that the role
+        is known to be valid.
+
+        Test: platform/mac/accessibility/invalid-menu-role-does-not-send-notification.html
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::updateRoleAfterChildrenCreation):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/WebAccessibilityObjectWrapperBase.mm:
+        (-[WebAccessibilityObjectWrapperBase updateObjectBackingStore]):
+
</ins><span class="cx"> 2014-03-24  Andy Estes  &lt;aestes@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         [iOS] Download support by CFURLDownloadRef under USE(CFNETWORK).
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAXObjectCachecpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AXObjectCache.cpp (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AXObjectCache.cpp        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/Source/WebCore/accessibility/AXObjectCache.cpp        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -684,6 +684,15 @@
</span><span class="cx"> #endif
</span><span class="cx"> 
</span><span class="cx">         AXNotification notification = note.second;
</span><ins>+        
+        // Ensure that this menu really is a menu. We do this check here so that we don't have to create
+        // the axChildren when the menu is marked as opening.
+        if (notification == AXMenuOpened) {
+            obj-&gt;updateChildrenIfNecessary();
+            if (obj-&gt;roleValue() != MenuRole)
+                continue;
+        }
+        
</ins><span class="cx">         postPlatformNotification(obj, notification);
</span><span class="cx"> 
</span><span class="cx">         if (notification == AXChildrenChanged &amp;&amp; obj-&gt;parentObjectIfExists() &amp;&amp; obj-&gt;lastKnownIsIgnoredValue() != obj-&gt;accessibilityIsIgnored())
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityObject.cpp (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityObject.cpp        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/Source/WebCore/accessibility/AccessibilityObject.cpp        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -1354,6 +1354,8 @@
</span><span class="cx">     // Updating the layout may delete this object.
</span><span class="cx">     if (Document* document = this-&gt;document())
</span><span class="cx">         document-&gt;updateLayoutIgnorePendingStylesheets();
</span><ins>+    
+    updateChildrenIfNecessary();
</ins><span class="cx"> }
</span><span class="cx"> #endif
</span><span class="cx"> 
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjectcpp"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.cpp        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -2995,6 +2995,24 @@
</span><span class="cx">     }
</span><span class="cx"> }
</span><span class="cx">     
</span><ins>+void AccessibilityRenderObject::updateRoleAfterChildrenCreation()
+{
+    // If a menu does not have valid menuitem children, it should not be exposed as a menu.
+    if (roleValue() == MenuRole) {
+        // Elements marked as menus must have at least one menu item child.
+        size_t menuItemCount = 0;
+        for (const auto&amp; child : children()) {
+            if (child-&gt;isMenuItem()) {
+                menuItemCount++;
+                break;
+            }
+        }
+
+        if (!menuItemCount)
+            m_role = GroupRole;
+    }
+}
+    
</ins><span class="cx"> void AccessibilityRenderObject::addChildren()
</span><span class="cx"> {
</span><span class="cx">     // If the need to add more children in addition to existing children arises, 
</span><span class="lines">@@ -3019,6 +3037,8 @@
</span><span class="cx"> #if PLATFORM(COCOA)
</span><span class="cx">     updateAttachmentViewParents();
</span><span class="cx"> #endif
</span><ins>+    
+    updateRoleAfterChildrenCreation();
</ins><span class="cx"> }
</span><span class="cx"> 
</span><span class="cx"> bool AccessibilityRenderObject::canHaveChildren() const
</span></span></pre></div>
<a id="trunkSourceWebCoreaccessibilityAccessibilityRenderObjecth"></a>
<div class="modfile"><h4>Modified: trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h (166193 => 166194)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h        2014-03-24 21:14:56 UTC (rev 166193)
+++ trunk/Source/WebCore/accessibility/AccessibilityRenderObject.h        2014-03-24 21:26:25 UTC (rev 166194)
</span><span class="lines">@@ -269,7 +269,8 @@
</span><span class="cx"> #endif
</span><span class="cx">     virtual String expandedTextValue() const;
</span><span class="cx">     virtual bool supportsExpandedTextValue() const;
</span><del>-
</del><ins>+    void updateRoleAfterChildrenCreation();
+    
</ins><span class="cx">     void ariaSelectedRows(AccessibilityChildrenVector&amp;);
</span><span class="cx">     
</span><span class="cx">     bool elementAttributeValue(const QualifiedName&amp;) const;
</span></span></pre>
</div>
</div>

</body>
</html>