1 files changed, 26 insertions, 18 deletions

diff --git a/Source/WebCore/accessibility/AccessibilitySpinButton.cpp b/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
index 955079483..11be8a916 100644
--- a/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
+++ b/Source/WebCore/accessibility/AccessibilitySpinButton.cpp
@@ -31,13 +31,13 @@
 
 namespace WebCore {
 
-PassRefPtr<AccessibilitySpinButton> AccessibilitySpinButton::create()
+Ref<AccessibilitySpinButton> AccessibilitySpinButton::create()
 {
-    return adoptRef(new AccessibilitySpinButton);
+    return adoptRef(*new AccessibilitySpinButton);
 }
     
 AccessibilitySpinButton::AccessibilitySpinButton()
-    : m_spinButtonElement(0)
+    : m_spinButtonElement(nullptr)
 {
 }
 
@@ -49,6 +49,8 @@ AccessibilityObject* AccessibilitySpinButton::incrementButton()
 {
     if (!m_haveChildren)
         addChildren();
+    if (!m_haveChildren)
+        return nullptr;
 
     ASSERT(m_children.size() == 2);
 
@@ -59,6 +61,8 @@ AccessibilityObject* AccessibilitySpinButton::decrementButton()
 {
     if (!m_haveChildren)
         addChildren();
+    if (!m_haveChildren)
+        return nullptr;
     
     ASSERT(m_children.size() == 2);
     
@@ -80,17 +84,21 @@ LayoutRect AccessibilitySpinButton::elementRect() const
 
 void AccessibilitySpinButton::addChildren()
 {
+    AXObjectCache* cache = axObjectCache();
+    if (!cache)
+        return;
+    
     m_haveChildren = true;
     
-    AccessibilitySpinButtonPart* incrementor = toAccessibilitySpinButtonPart(axObjectCache()->getOrCreate(SpinButtonPartRole));
-    incrementor->setIsIncrementor(true);
-    incrementor->setParent(this);
-    m_children.append(incrementor);
+    auto& incrementor = downcast<AccessibilitySpinButtonPart>(*cache->getOrCreate(SpinButtonPartRole));
+    incrementor.setIsIncrementor(true);
+    incrementor.setParent(this);
+    m_children.append(&incrementor);
 
-    AccessibilitySpinButtonPart* decrementor = toAccessibilitySpinButtonPart(axObjectCache()->getOrCreate(SpinButtonPartRole));
-    decrementor->setIsIncrementor(false);
-    decrementor->setParent(this);
-    m_children.append(decrementor);
+    auto& decrementor = downcast<AccessibilitySpinButtonPart>(*cache->getOrCreate(SpinButtonPartRole));
+    decrementor.setIsIncrementor(false);
+    decrementor.setParent(this);
+    m_children.append(&decrementor);
 }
     
 void AccessibilitySpinButton::step(int amount)
@@ -109,9 +117,9 @@ AccessibilitySpinButtonPart::AccessibilitySpinButtonPart()
 {
 }
     
-PassRefPtr<AccessibilitySpinButtonPart> AccessibilitySpinButtonPart::create()
+Ref<AccessibilitySpinButtonPart> AccessibilitySpinButtonPart::create()
 {
-    return adoptRef(new AccessibilitySpinButtonPart);
+    return adoptRef(*new AccessibilitySpinButtonPart);
 }
 
 LayoutRect AccessibilitySpinButtonPart::elementRect() const
@@ -130,16 +138,16 @@ LayoutRect AccessibilitySpinButtonPart::elementRect() const
     return parentRect;
 }
 
-bool AccessibilitySpinButtonPart::press() const
+bool AccessibilitySpinButtonPart::press()
 {
-    if (!m_parent || !m_parent->isSpinButton())
+    if (!is<AccessibilitySpinButton>(m_parent))
         return false;
     
-    AccessibilitySpinButton* spinButton = toAccessibilitySpinButton(parentObject());
+    auto& spinButton = downcast<AccessibilitySpinButton>(*m_parent);
     if (m_isIncrementor)
-        spinButton->step(1);
+        spinButton.step(1);
     else
-        spinButton->step(-1);
+        spinButton.step(-1);
     
     return true;
 }