Merge 130266 - AX: Heap-use-after-free when deleting a ContainerNode with an AX object

Source/WebCore/dom/Node.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 408 matching lines @@
     // of (1) a Document node or (2) a DocumentType node that is not used with any Document yet. 
     Document* ownerDocument() const;
 
     // Returns the document associated with this node. This method never returns NULL, except in the case 
     // of a DocumentType node that is not used with any Document yet. A Document node returns itself.
     Document* document() const
     {
         ASSERT(this);
         // FIXME: below ASSERT is useful, but prevents the use of document() in the constructor or destructor
         // due to the virtual function call to nodeType().
-        ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-        return m_document;
+        ASSERT(documentInternal() || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
+        return documentInternal();
     }
 
     TreeScope* treeScope() const;
 
     // Returns true if this node is associated with a document and is in its associated document's
     // node tree, false otherwise.
     bool inDocument() const 
     { 
         ASSERT(m_document || !getFlag(InDocumentFlag));
         return getFlag(InDocumentFlag);
@@ skipping 301 matching lines @@
     void clearTabIndexExplicitly();
     
     bool hasRareData() const { return getFlag(HasRareDataFlag); }
 
     NodeRareData* rareData() const;
     NodeRareData* ensureRareData();
     void clearRareData();
 
     void setHasCustomCallbacks() { setFlag(true, HasCustomCallbacksFlag); }
 
+    Document* documentInternal() const { return m_document; }
+
 private:
     friend class TreeShared<Node, ContainerNode>;
 
     void removedLastRef();
 
     // These API should be only used for a tree scope migration.
     // setTreeScope() returns NodeRareData to save extra nodeRareData() invocations on the caller site.
     NodeRareData* setTreeScope(TreeScope*);
     void setDocument(Document*);
 
@@ skipping 124 matching lines @@
 
 } //namespace
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
 void showTree(const WebCore::Node*);
 void showNodePath(const WebCore::Node*);
 #endif
 
 #endif