Fix leaking AXNodeObjects when sub document detaches

third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

 /*
  * Copyright (C) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 2124 matching lines @@
         parentNode = toHTMLOptionElement(node)->ownerSelectElement();
 
     if (!parentNode)
         parentNode = node->parentNode();
 
     return parentNode;
 }
 
 AXObject* AXNodeObject::computeParent() const
 {
+    ASSERT(!isDetached());
     if (Node* parentNode = getParentNodeForComputeParent(node()))
         return axObjectCache().getOrCreate(parentNode);
 
     return nullptr;
 }
 
 AXObject* AXNodeObject::computeParentIfExists() const
 {
     if (Node* parentNode = getParentNodeForComputeParent(node()))
         return axObjectCache().get(parentNode);
@@ skipping 21 matching lines @@
 
     Node* nextSibling = node()->nextSibling();
     if (!nextSibling)
         return 0;
 
     return axObjectCache().getOrCreate(nextSibling);
 }
 
 void AXNodeObject::addChildren()
 {
+    ASSERT(!isDetached());
     // If the need to add more children in addition to existing children arises,
     // childrenChanged should have been called, leaving the object with no children.
     ASSERT(!m_haveChildren);
 
     if (!m_node)
         return;
 
     m_haveChildren = true;
 
     // The only time we add children from the DOM tree to a node with a layoutObject is when it's a canvas.
@@ skipping 915 matching lines @@
     return String();
 }
 
 DEFINE_TRACE(AXNodeObject)
 {
     visitor->trace(m_node);
     AXObject::trace(visitor);
 }
 
 } // namespace blin