Merge 130266 - AX: Heap-use-after-free when deleting a ContainerNode with an AX object

Source/WebCore/dom/Node.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 396 matching lines @@
     liveNodeSet.remove(this);
 #endif
 
     if (hasRareData())
         clearRareData();
 
     if (renderer())
         detach();
 
     Document* doc = m_document;
-    if (AXObjectCache::accessibilityEnabled() && doc && doc->axObjectCacheExists())
+    if (AXObjectCache::accessibilityEnabled() && doc && doc->axObjectCacheExists() && !isContainerNode())
         doc->axObjectCache()->remove(this);
     
     if (m_previous)
         m_previous->setNextSibling(0);
     if (m_next)
         m_next->setPreviousSibling(0);
 
     if (doc)
         doc->guardDeref();
 
@@ skipping 2400 matching lines @@
         node->showTreeForThis();
 }
 
 void showNodePath(const WebCore::Node* node)
 {
     if (node)
         node->showNodePathForThis();
 }
 
 #endif