Fix leaking AXNodeObjects when sub document detaches

third_party/WebKit/Source/modules/accessibility/AXSpinButton.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 62 matching lines @@
     m_spinButtonElement = nullptr;
 }
 
 AccessibilityRole AXSpinButton::roleValue() const
 {
     return m_spinButtonElement ? SpinButtonRole : UnknownRole;
 }
 
 void AXSpinButton::addChildren()
 {
+    ASSERT(!isDetached());
     m_haveChildren = true;
 
     AXSpinButtonPart* incrementor = toAXSpinButtonPart(axObjectCache().getOrCreate(SpinButtonPartRole));
     incrementor->setIsIncrementor(true);
     incrementor->setParent(this);
     m_children.append(incrementor);
 
     AXSpinButtonPart* decrementor = toAXSpinButtonPart(axObjectCache().getOrCreate(SpinButtonPartRole));
     decrementor->setIsIncrementor(false);
     decrementor->setParent(this);
@@ skipping 46 matching lines @@
     AXSpinButton* spinButton = toAXSpinButton(parentObject());
     if (m_isIncrementor)
         spinButton->step(1);
     else
         spinButton->step(-1);
 
     return true;
 }
 
 } // namespace blink