<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[188295] branches/safari-601.1-branch</title>
</head>
<body>

<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt;  }
#msg dl a { font-weight: bold}
#msg dl a:link    { color:#fc3; }
#msg dl a:active  { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff  {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/188295">188295</a></dd>
<dt>Author</dt> <dd>matthew_hanson@apple.com</dd>
<dt>Date</dt> <dd>2015-08-11 14:19:42 -0700 (Tue, 11 Aug 2015)</dd>
</dl>

<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/188203">r188203</a>. rdar://problem/22026625</pre>

<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari6011branchLayoutTestsChangeLog">branches/safari-601.1-branch/LayoutTests/ChangeLog</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreChangeLog">branches/safari-601.1-branch/Source/WebCore/ChangeLog</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilityAccessibilityARIAGridcpp">branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTablecpp">branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.cpp</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableh">branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.h</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableCellcpp">branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableCell.cpp</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableRowcpp">branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableRow.cpp</a></li>
<li><a href="#branchessafari6011branchSourceWebCoreaccessibilitymacWebAccessibilityObjectWrapperMacmm">branches/safari-601.1-branch/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm</a></li>
</ul>

<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari6011branchLayoutTestsaccessibilitymacmalformedtableexpectedtxt">branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table-expected.txt</a></li>
<li><a href="#branchessafari6011branchLayoutTestsaccessibilitymacmalformedtablehtml">branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table.html</a></li>
</ul>

</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari6011branchLayoutTestsChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/LayoutTests/ChangeLog (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/LayoutTests/ChangeLog        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/LayoutTests/ChangeLog        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -1,3 +1,24 @@
</span><ins>+2015-08-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
+
+        Merge r188203. rdar://problem/22026625
+
+    2015-08-09  Nan Wang  &lt;n_wang@apple.com&gt;
+
+            AX: CSS table display styles can cause malformed, inaccessible AXTables to be exposed to the AX tree
+            https://bugs.webkit.org/show_bug.cgi?id=136415
+            &lt;rdar://problem/22026625&gt;
+
+            Reviewed by Chris Fleizach.
+
+            * accessibility/aria-table-with-presentational-elements-expected.txt:
+            * accessibility/aria-table-with-presentational-elements.html:
+            * accessibility/mac/malformed-table-expected.txt: Added.
+            * accessibility/mac/malformed-table.html: Added.
+            * platform/mac-mavericks/accessibility/roles-exposed-expected.txt:
+            * platform/mac/accessibility/aria-table-hierarchy-expected.txt:
+            * platform/mac/accessibility/aria-tables-expected.txt:
+            * platform/mac/accessibility/roles-exposed-expected.txt:
+
</ins><span class="cx"> 2015-08-11  Alexey Proskuryakov  &lt;ap@apple.com&gt;
</span><span class="cx"> 
</span><span class="cx">         Merge r187595.
</span></span></pre></div>
<a id="branchessafari6011branchLayoutTestsaccessibilitymacmalformedtableexpectedtxt"></a>
<div class="addfile"><h4>Added: branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table-expected.txt (0 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table-expected.txt                                (rev 0)
+++ branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table-expected.txt        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -0,0 +1,53 @@
</span><ins>+Table with CSS and ARIA
+Heading one        Heading two
+a        b
+Table with CSS and no ARIA
+Heading one        Heading two
+a        b
+This tests that contents in malformed tables are accessible.
+
+On success, you will see a series of &quot;PASS&quot; messages, followed by &quot;TEST COMPLETE&quot;.
+
+
+PASS table1.role is 'AXRole: AXTable'
+PASS table2.role is 'AXRole: AXTable'
+PASS table1ColumnCount is 2
+PASS table1RowCount is 2
+PASS table2ColumnCount is 2
+PASS table2RowCount is 2
+
+Check rows for Table1
+PASS rowa.isEqual(rowb) is true
+PASS rowa.role is 'AXRole: AXRow'
+PASS rowa.isEqual(rowb) is true
+PASS rowa.role is 'AXRole: AXRow'
+
+Check rows for Table2
+PASS rowa.isEqual(rowb) is true
+PASS rowa.role is 'AXRole: AXRow'
+PASS rowa.isEqual(rowb) is true
+PASS rowa.role is 'AXRole: AXRow'
+
+Check cells for Table1
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+
+Check cells for Table2
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS cella.isEqual(cellb) is true
+PASS cella.role is 'AXRole: AXCell'
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
</ins></span></pre></div>
<a id="branchessafari6011branchLayoutTestsaccessibilitymacmalformedtablehtml"></a>
<div class="addfile"><h4>Added: branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table.html (0 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table.html                                (rev 0)
+++ branches/safari-601.1-branch/LayoutTests/accessibility/mac/malformed-table.html        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -0,0 +1,107 @@
</span><ins>+&lt;!DOCTYPE&gt;
+&lt;html&gt;
+&lt;script src=&quot;../../resources/js-test-pre.js&quot;&gt;&lt;/script&gt;
+&lt;head&gt;
+    &lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=utf-8&quot;&gt;
+    &lt;title&gt;Table test&lt;/title&gt;
+    &lt;style&gt;
+    table {border: 1px solid;}
+    table th {background-color: #eeeeee;}
+    table td {background-color: #dddddd;}
+    .table thead {display:block;}
+    .table tbody {display:block;}
+    .table2 thead {display:block;}
+    .table2 tbody {display:block;}
+    &lt;/style&gt;
+&lt;/head&gt;
+&lt;body id=&quot;body&quot;&gt;
+
+&lt;table role=&quot;grid&quot; class=&quot;table&quot; id=&quot;table&quot;&gt;
+    &lt;caption&gt;Table with CSS and ARIA&lt;/caption&gt;
+    &lt;thead&gt;
+        &lt;tr role=&quot;row&quot;&gt;
+            &lt;th role=&quot;gridcell&quot;&gt;Heading one&lt;/th&gt;
+            &lt;th role=&quot;gridcell&quot;&gt;Heading two&lt;/th&gt;
+        &lt;/tr&gt;
+    &lt;/thead&gt;
+    &lt;tbody&gt;
+        &lt;tr role=&quot;row&quot;&gt;
+            &lt;td role=&quot;gridcell&quot;&gt;a&lt;/td&gt;
+            &lt;td role=&quot;gridcell&quot;&gt;b&lt;/td&gt;
+        &lt;/tr&gt;
+    &lt;/tbody&gt;
+&lt;/table&gt;
+
+&lt;table class=&quot;table2&quot; id=&quot;table2&quot;&gt;
+    &lt;caption&gt;Table with CSS and no ARIA&lt;/caption&gt;
+    &lt;thead&gt;
+        &lt;tr&gt;
+            &lt;th&gt;Heading one&lt;/th&gt;
+            &lt;th&gt;Heading two&lt;/th&gt;
+        &lt;/tr&gt;
+    &lt;/thead&gt;
+    &lt;tbody&gt;
+        &lt;tr&gt;
+            &lt;td&gt;a&lt;/td&gt;
+            &lt;td&gt;b&lt;/td&gt;
+        &lt;/tr&gt;
+    &lt;tbody&gt;
+&lt;/table&gt;
+
+&lt;p id=&quot;description&quot;&gt;&lt;/p&gt;
+&lt;div id=&quot;console&quot;&gt;&lt;/div&gt;
+
+&lt;script&gt;
+
+    description(&quot;This tests that contents in malformed tables are accessible.&quot;);
+
+    if (window.accessibilityController) {
+        var table1 = accessibilityController.accessibleElementById(&quot;table&quot;);
+        var table2 = accessibilityController.accessibleElementById(&quot;table2&quot;);
+        var tableArray = [table1, table2];
+        // check for table role
+        shouldBe(&quot;table1.role&quot;, &quot;'AXRole: AXTable'&quot;);
+        shouldBe(&quot;table2.role&quot;, &quot;'AXRole: AXTable'&quot;);
+
+        // check for correct column and row count
+        var table1ColumnCount = table1.numberAttributeValue(&quot;AXColumnCount&quot;);
+        var table1RowCount = table1.numberAttributeValue(&quot;AXRowCount&quot;);
+        var table2ColumnCount = table2.numberAttributeValue(&quot;AXColumnCount&quot;);
+        var table2RowCount = table2.numberAttributeValue(&quot;AXRowCount&quot;);
+        shouldBe(&quot;table1ColumnCount&quot;, &quot;2&quot;);
+        shouldBe(&quot;table1RowCount&quot;, &quot;2&quot;);
+        shouldBe(&quot;table2ColumnCount&quot;, &quot;2&quot;);
+        shouldBe(&quot;table2RowCount&quot;, &quot;2&quot;);
+
+        // check rows
+        for (var tableIndex = 0; tableIndex &lt; 2; tableIndex++) {
+            debug(&quot;\nCheck rows for Table&quot; + (tableIndex+1));
+            var table = tableArray[tableIndex];
+            for (var i = 0; i &lt; 2; i++) {
+                var rowa = table.rowAtIndex(i);
+                var rowb = table.childAtIndex(i);
+                shouldBeTrue(&quot;rowa.isEqual(rowb)&quot;);
+                shouldBe(&quot;rowa.role&quot;, &quot;'AXRole: AXRow'&quot;);
+            }
+        }
+
+        // check cells
+        for (var tableIndex = 0; tableIndex &lt; 2; tableIndex++) {
+            debug(&quot;\nCheck cells for Table&quot; + (tableIndex+1));
+            var table = tableArray[tableIndex];
+            for (var i = 0; i &lt; 2; i++) {
+                for (var j = 0; j &lt; 2; j++) {
+                    var cella = table.cellForColumnAndRow(i, j);
+                    var cellb = table.childAtIndex(j).childAtIndex(i);
+                    shouldBeTrue(&quot;cella.isEqual(cellb)&quot;);
+                    shouldBe(&quot;cella.role&quot;, &quot;'AXRole: AXCell'&quot;);
+                }
+            }
+        }
+    }
+
+&lt;/script&gt;
+
+&lt;script src=&quot;../../resources/js-test-post.js&quot;&gt;&lt;/script&gt;
+&lt;/body&gt;
+&lt;/html&gt;
</ins></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/ChangeLog (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/ChangeLog        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/ChangeLog        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -1,5 +1,39 @@
</span><span class="cx"> 2015-08-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
</span><span class="cx"> 
</span><ins>+        Merge r188203. rdar://problem/22026625
+
+    2015-08-09  Nan Wang  &lt;n_wang@apple.com&gt;
+
+            AX: CSS table display styles can cause malformed, inaccessible AXTables to be exposed to the AX tree
+            https://bugs.webkit.org/show_bug.cgi?id=136415
+            &lt;rdar://problem/22026625&gt;
+
+            Reviewed by Chris Fleizach.
+
+            Applying CSS display styles to tables can end up inserting anonymous RenderTableRows, which is not handled well by the
+            accessibility code, which treats these as the actual rows. We can address this by diving deeper into anonymous nodes
+            and finding the real rows and cells we want. In addition, another thing also causing malformed tables is that &quot;grid&quot;
+            roles are being exposed as AXGrid instead of AXTable.
+
+            Test: accessibility/mac/malformed-table.html
+
+            * accessibility/AccessibilityARIAGrid.cpp:
+            (WebCore::AccessibilityARIAGrid::addRowDescendant):
+            * accessibility/AccessibilityTable.cpp:
+            (WebCore::AccessibilityTable::addChildren):
+            (WebCore::AccessibilityTable::addTableCellChild):
+            (WebCore::AccessibilityTable::addChildrenFromSection):
+            * accessibility/AccessibilityTable.h:
+            * accessibility/AccessibilityTableCell.cpp:
+            (WebCore::AccessibilityTableCell::parentTable):
+            (WebCore::AccessibilityTableCell::rowIndexRange):
+            * accessibility/AccessibilityTableRow.cpp:
+            (WebCore::AccessibilityTableRow::parentTable):
+            * accessibility/mac/WebAccessibilityObjectWrapperMac.mm:
+            (createAccessibilityRoleMap):
+
+2015-08-11  Matthew Hanson  &lt;matthew_hanson@apple.com&gt;
+
</ins><span class="cx">         Merge r188243. rdar://problem/22102378
</span><span class="cx"> 
</span><span class="cx">     2015-08-10  Myles C. Maxfield  &lt;mmaxfield@apple.com&gt;
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilityAccessibilityARIAGridcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityARIAGrid.cpp        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -87,9 +87,9 @@
</span><span class="cx">     if (!rowChild)
</span><span class="cx">         return;
</span><span class="cx"> 
</span><del>-    if (!rowChild-&gt;isTableRow()) {
</del><ins>+    if (!rowChild-&gt;isTableRow() || !rowChild-&gt;node()) {
</ins><span class="cx">         // Although a &quot;grid&quot; should have rows as its direct descendants, if this is not a table row,
</span><del>-        // dive deeper into the descendants to try to find a valid row.
</del><ins>+        // or this row is anonymous, dive deeper into the descendants to try to find a valid row.
</ins><span class="cx">         for (const auto&amp; child : rowChild-&gt;children())
</span><span class="cx">             addRowDescendant(child.get(), appendedRows, columnCount);
</span><span class="cx">     } else
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTablecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.cpp (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.cpp        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.cpp        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -44,6 +44,8 @@
</span><span class="cx"> #include &quot;RenderTableCell.h&quot;
</span><span class="cx"> #include &quot;RenderTableSection.h&quot;
</span><span class="cx"> 
</span><ins>+#include &lt;wtf/Deque.h&gt;
+
</ins><span class="cx"> namespace WebCore {
</span><span class="cx"> 
</span><span class="cx"> using namespace HTMLNames;
</span><span class="lines">@@ -421,6 +423,29 @@
</span><span class="cx"> 
</span><span class="cx"> }
</span><span class="cx"> 
</span><ins>+void AccessibilityTable::addTableCellChild(AccessibilityObject* rowObject, HashSet&lt;AccessibilityObject*&gt;&amp; appendedRows, unsigned&amp; columnCount)
+{
+    if (!rowObject || !is&lt;AccessibilityTableRow&gt;(*rowObject))
+        return;
+
+    auto&amp; row = downcast&lt;AccessibilityTableRow&gt;(*rowObject);
+    // We need to check every cell for a new row, because cell spans
+    // can cause us to miss rows if we just check the first column.
+    if (appendedRows.contains(&amp;row))
+        return;
+    
+    row.setRowIndex(static_cast&lt;int&gt;(m_rows.size()));
+    m_rows.append(&amp;row);
+    if (!row.accessibilityIsIgnored())
+        m_children.append(&amp;row);
+    appendedRows.add(&amp;row);
+        
+    // store the maximum number of columns
+    unsigned rowCellCount = row.children().size();
+    if (rowCellCount &gt; columnCount)
+        columnCount = rowCellCount;
+}
+
</ins><span class="cx"> void AccessibilityTable::addChildrenFromSection(RenderTableSection* tableSection, unsigned&amp; maxColumnCount)
</span><span class="cx"> {
</span><span class="cx">     ASSERT(tableSection);
</span><span class="lines">@@ -437,20 +462,23 @@
</span><span class="cx">             continue;
</span><span class="cx">         
</span><span class="cx">         AccessibilityObject&amp; rowObject = *axCache-&gt;getOrCreate(renderRow);
</span><del>-        if (!is&lt;AccessibilityTableRow&gt;(rowObject))
-            continue;
</del><span class="cx">         
</span><del>-        auto&amp; row = downcast&lt;AccessibilityTableRow&gt;(rowObject);
-        // We need to check every cell for a new row, because cell spans
-        // can cause us to miss rows if we just check the first column.
-        if (appendedRows.contains(&amp;row))
-            continue;
-        
-        row.setRowIndex(static_cast&lt;int&gt;(m_rows.size()));
-        m_rows.append(&amp;row);
-        if (!row.accessibilityIsIgnored())
-            m_children.append(&amp;row);
-        appendedRows.add(&amp;row);
</del><ins>+        // If the row is anonymous, we should dive deeper into the descendants to try to find a valid row.
+        if (renderRow-&gt;isAnonymous()) {
+            Deque&lt;AccessibilityObject*&gt; queue;
+            queue.append(&amp;rowObject);
+            
+            while (!queue.isEmpty()) {
+                AccessibilityObject* obj = queue.takeFirst();
+                if (obj-&gt;node() &amp;&amp; is&lt;AccessibilityTableRow&gt;(*obj)) {
+                    addTableCellChild(obj, appendedRows, maxColumnCount);
+                    continue;
+                }
+                for (auto child = obj-&gt;firstChild(); child; child = child-&gt;nextSibling())
+                    queue.append(child);
+            }
+        } else
+            addTableCellChild(&amp;rowObject, appendedRows, maxColumnCount);
</ins><span class="cx">     }
</span><span class="cx">     
</span><span class="cx">     maxColumnCount = std::max(tableSection-&gt;numColumns(), maxColumnCount);
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableh"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.h (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.h        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTable.h        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -98,6 +98,7 @@
</span><span class="cx">     virtual void titleElementText(Vector&lt;AccessibilityText&gt;&amp;) const override final;
</span><span class="cx">     HTMLTableElement* tableElement() const;
</span><span class="cx">     void addChildrenFromSection(RenderTableSection*, unsigned&amp; maxColumnCount);
</span><ins>+    void addTableCellChild(AccessibilityObject*, HashSet&lt;AccessibilityObject*&gt;&amp; appendedRows, unsigned&amp; columnCount);
</ins><span class="cx"> };
</span><span class="cx"> 
</span><span class="cx"> } // namespace WebCore 
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableCellcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableCell.cpp (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableCell.cpp        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableCell.cpp        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -93,6 +93,24 @@
</span><span class="cx">     AccessibilityObject* parentTable = axObjectCache()-&gt;get(downcast&lt;RenderTableCell&gt;(*m_renderer).table());
</span><span class="cx">     if (!is&lt;AccessibilityTable&gt;(parentTable))
</span><span class="cx">         return nullptr;
</span><ins>+    
+    // The RenderTableCell's table() object might be anonymous sometimes. We should handle it gracefully
+    // by finding the right table.
+    if (!parentTable-&gt;node()) {
+        for (AccessibilityObject* parent = parentObject(); parent; parent = parent-&gt;parentObject()) {
+            // If this is a non-anonymous table object, but not an accessibility table, we should stop because
+            // we don't want to choose another ancestor table as this cell's table.
+            if (is&lt;AccessibilityTable&gt;(*parent)) {
+                auto&amp; parentTable = downcast&lt;AccessibilityTable&gt;(*parent);
+                if (parentTable.isExposableThroughAccessibility())
+                    return &amp;parentTable;
+                if (parentTable.node())
+                    break;
+            }
+        }
+        return nullptr;
+    }
+    
</ins><span class="cx">     return downcast&lt;AccessibilityTable&gt;(parentTable);
</span><span class="cx"> }
</span><span class="cx">     
</span><span class="lines">@@ -306,8 +324,15 @@
</span><span class="cx">         // Don't add row offsets for bottom sections that are placed in before the body section.
</span><span class="cx">         if (tableSection == footerSection)
</span><span class="cx">             continue;
</span><del>-        if (tableSection == section)
</del><ins>+        if (tableSection == section) {
+            // If the table section is anonymous, we should to use the parent row's API to get the rowIndex
+            if (tableSection-&gt;isAnonymous()) {
+                AccessibilityObject* parent = parentObjectUnignored();
+                if (is&lt;AccessibilityTableRow&gt;(*parent))
+                    rowOffset = downcast&lt;AccessibilityTableRow&gt;(*parent).rowIndex();
+            }
</ins><span class="cx">             break;
</span><ins>+        }
</ins><span class="cx">         rowOffset += tableSection-&gt;numRows();
</span><span class="cx">     }
</span><span class="cx"> 
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilityAccessibilityTableRowcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableRow.cpp (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableRow.cpp        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/AccessibilityTableRow.cpp        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -98,13 +98,14 @@
</span><span class="cx">     // The parent table might not be the direct ancestor of the row unfortunately. ARIA states that role=&quot;grid&quot; should
</span><span class="cx">     // only have &quot;row&quot; elements, but if not, we still should handle it gracefully by finding the right table.
</span><span class="cx">     for (AccessibilityObject* parent = parentObject(); parent; parent = parent-&gt;parentObject()) {
</span><del>-        // If this is a table object, but not an accessibility table, we should stop because we don't want to
</del><ins>+        // If this is a non-anonymous table object, but not an accessibility table, we should stop because we don't want to
</ins><span class="cx">         // choose another ancestor table as this row's table.
</span><span class="cx">         if (is&lt;AccessibilityTable&gt;(*parent)) {
</span><span class="cx">             auto&amp; parentTable = downcast&lt;AccessibilityTable&gt;(*parent);
</span><span class="cx">             if (parentTable.isExposableThroughAccessibility())
</span><span class="cx">                 return &amp;parentTable;
</span><del>-            break;
</del><ins>+            if (parentTable.node())
+                break;
</ins><span class="cx">         }
</span><span class="cx">     }
</span><span class="cx">     
</span></span></pre></div>
<a id="branchessafari6011branchSourceWebCoreaccessibilitymacWebAccessibilityObjectWrapperMacmm"></a>
<div class="modfile"><h4>Modified: branches/safari-601.1-branch/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm (188294 => 188295)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-601.1-branch/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm        2015-08-11 21:13:08 UTC (rev 188294)
+++ branches/safari-601.1-branch/Source/WebCore/accessibility/mac/WebAccessibilityObjectWrapperMac.mm        2015-08-11 21:19:42 UTC (rev 188295)
</span><span class="lines">@@ -1918,7 +1918,7 @@
</span><span class="cx">         { RulerMarkerRole, NSAccessibilityRulerMarkerRole },
</span><span class="cx">         { LinkRole, NSAccessibilityLinkRole },
</span><span class="cx">         { DisclosureTriangleRole, NSAccessibilityDisclosureTriangleRole },
</span><del>-        { GridRole, NSAccessibilityGridRole },
</del><ins>+        { GridRole, NSAccessibilityTableRole },
</ins><span class="cx">         { WebCoreLinkRole, NSAccessibilityLinkRole },
</span><span class="cx">         { ImageMapLinkRole, NSAccessibilityLinkRole },
</span><span class="cx">         { ImageMapRole, @&quot;AXImageMap&quot; },
</span></span></pre>
</div>
</div>

</body>
</html>