Merge 130266 - AX: Heap-use-after-free when deleting a ContainerNode with an AX object

Source/WebCore/dom/Node.h

Index: Source/WebCore/dom/Node.h
===================================================================
--- Source/WebCore/dom/Node.h	(revision 131770)
+++ Source/WebCore/dom/Node.h	(working copy)
@@ -426,8 +426,8 @@
         ASSERT(this);
         // FIXME: below ASSERT is useful, but prevents the use of document() in the constructor or destructor
         // due to the virtual function call to nodeType().
-        ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
-        return m_document;
+        ASSERT(documentInternal() || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
+        return documentInternal();
     }
 
     TreeScope* treeScope() const;
@@ -749,6 +749,8 @@
 
     void setHasCustomCallbacks() { setFlag(true, HasCustomCallbacksFlag); }
 
+    Document* documentInternal() const { return m_document; }
+
 private:
     friend class TreeShared<Node, ContainerNode>;