Mac a11y: Fix AXTextMarker leaks.

content/browser/accessibility/browser_accessibility_cocoa.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "content/browser/accessibility/browser_accessibility_cocoa.h"
 
 #include <execinfo.h>
 #include <stddef.h>
 #include <stdint.h>
 #include <string.h>
@@ skipping 122 matching lines @@
 AXTextMarkerRef AXTextMarkerRangeCopyStartMarker(
     AXTextMarkerRangeRef text_marker_range);
 
 AXTextMarkerRef AXTextMarkerRangeCopyEndMarker(
     AXTextMarkerRangeRef text_marker_range);
 
 #endif  // MAC_OS_X_VERSION_10_11
 
 }  // extern "C"
 
-// to call |release| on it to transfer ownership of the position to the text
-// marker object.
+// AXTextMarkerCreate copies from data buffer given to it.
 id CreateTextMarker(AXPlatformPositionInstance position) {
   AXTextMarkerRef text_marker = AXTextMarkerCreate(
-      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(position.release()),
+      kCFAllocatorDefault, reinterpret_cast<const UInt8*>(position.get()),
       sizeof(AXPlatformPosition));
   return static_cast<id>(
       base::mac::CFTypeRefToNSObjectAutorelease(text_marker));
 }
 
-// |range| is destructed at the end of this method and ownership of its |anchor|
-// and |focus| are transfered to the marker range object.
+// |range| is destructed at the end of this method. |anchor| and |focus| are
+// copied into the individual text markers.
 id CreateTextMarkerRange(const AXPlatformRange range) {
-  AXTextMarkerRef start_marker = AXTextMarkerCreate(
+  base::ScopedCFTypeRef<AXTextMarkerRef> start_marker(AXTextMarkerCreate(
       kCFAllocatorDefault, reinterpret_cast<const UInt8*>(range.anchor()),
-      sizeof(AXPlatformPosition));
-  AXTextMarkerRef end_marker = AXTextMarkerCreate(
+      sizeof(AXPlatformPosition)));
+  base::ScopedCFTypeRef<AXTextMarkerRef> end_marker(AXTextMarkerCreate(
       kCFAllocatorDefault, reinterpret_cast<const UInt8*>(range.focus()),
-      sizeof(AXPlatformPosition));
+      sizeof(AXPlatformPosition)));
   AXTextMarkerRangeRef marker_range =
       AXTextMarkerRangeCreate(kCFAllocatorDefault, start_marker, end_marker);
   return static_cast<id>(
       base::mac::CFTypeRefToNSObjectAutorelease(marker_range));
 }
 
 AXPlatformPositionInstance CreatePositionFromTextMarker(
     AXTextMarkerRef text_marker) {
   DCHECK(text_marker);
   if (AXTextMarkerGetLength(text_marker) != sizeof(AXPlatformPosition))
@@ skipping 2707 matching lines @@
 }
 
 - (BOOL)accessibilityNotifiesWhenDestroyed {
   // Indicate that BrowserAccessibilityCocoa will post a notification when it's
   // destroyed (see -detach). This allows VoiceOver to do some internal things
   // more efficiently.
   return YES;
 }
 
 @end