Oilpan: Prepare moving AXObject to heap

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 67d2aade857ba3a23849345346db45b872b6a5fb..f5afc1bc26e30eba211ce611ac1449caab9f2877 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -2185,8 +2185,13 @@ void Document::detach(const AttachContext& context)
             frameHost()->chromeClient().focusedNodeChanged(oldFocusedElement.get(), nullptr);
     }
 
-    if (this == &axObjectCacheOwner())
+    if (this == &axObjectCacheOwner()) {
         clearAXObjectCache();
+    } else if (AXObjectCache* cache = existingAXObjectCache()) {
+        for (Element& element : ElementTraversal::descendantsOf(*this)) {
+            cache->remove(&element);
+        }
+    }
 
     m_layoutView = nullptr;
     ContainerNode::detach(context);