Move AXObjectCache::remove so it is after ContainerNode::detach

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index 54ab2be7d7b9cd06c5957495d4213e434870a6bb..1e286b4ed3df9fb86d245d73529ca26dfc5c19e8 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -2195,6 +2195,18 @@ void Document::detach(const AttachContext& context)
     m_layoutView = nullptr;
     ContainerNode::detach(context);
 
+    if (this != &axObjectCacheOwner()) {
+        if (AXObjectCache* cache = existingAXObjectCache()) {
+            // Documents that are not a root document use the AXObjectCache in
+            // their root document. Node::removedFrom is called after the
+            // document has been detached so it can't find the root document.
+            // We do the removals here instead.
+            for (Node& node : NodeTraversal::descendantsOf(*this)) {
+                cache->remove(&node);
+            }
+        }
+    }
+
     styleEngine().didDetach();
 
     frameHost()->eventHandlerRegistry().documentDetached(*this);