Fix leaking AXNodeObjects when sub document detaches

third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp

 /*
  * Copyright (C) 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 61 matching lines @@
     // There's no reason to clear our AXMenuListPopup child. If we get a
     // call to clearChildren, it's because the options might have changed,
     // so call it on our popup.
     ASSERT(m_children.size() == 1);
     m_children[0]->clearChildren();
     m_childrenDirty = false;
 }
 
 void AXMenuList::addChildren()
 {
+    ASSERT(!isDetached());
     m_haveChildren = true;
 
     AXObjectCacheImpl& cache = axObjectCache();
 
     AXObject* list = cache.getOrCreate(MenuListPopupRole);
     if (!list)
         return;
 
     toAXMockObject(list)->setParent(this);
     if (list->accessibilityIsIgnored()) {
@@ skipping 63 matching lines @@
         return;
 
     AXMenuListPopup* popup = toAXMenuListPopup(children()[0].get());
     popup->didHide();
 
     if (node() && node()->focused())
         axObjectCache().postNotification(this, AXObjectCacheImpl::AXFocusedUIElementChanged);
 }
 
 } // namespace blink