<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>120501</bug_id>
          
          <creation_ts>2013-08-29 16:38:25 -0700</creation_ts>
          <short_desc>Avoid Node references from AXObjectCache from leaking</short_desc>
          <delta_ts>2013-09-04 08:44:06 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>Accessibility</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords>BlinkMergeCandidate, InRadar</keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Ryosuke Niwa">rniwa</reporter>
          <assigned_to name="Ryosuke Niwa">rniwa</assigned_to>
          <cc>cfleizach</cc>
    
    <cc>darin</cc>
    
    <cc>ggaren</cc>
    
    <cc>jcraig</cc>
    
    <cc>webkit-bug-importer</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>922734</commentid>
    <comment_count>0</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2013-08-29 16:38:25 -0700</bug_when>
    <thetext>Merge https://chromium.googlesource.com/chromium/blink/+/454f31497613b6d0fbcfb0df757254b64a177c06

A real world example of this would be selecting an &lt;option&gt; item inside frame by keyboard. The node will not be deref()-ed until the topDocument() is detached. 

The issue was that AccessibilityMenuListOption is created in childrenChanged()
hook called when its RenderObject is being destroyed. This patch modifies AccessibilityMenuListPopup so it won&apos;t create AccessibilityMenuListOption if its
element is already detached.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>922735</commentid>
    <comment_count>1</comment_count>
    <who name="Radar WebKit Bug Importer">webkit-bug-importer</who>
    <bug_when>2013-08-29 16:38:36 -0700</bug_when>
    <thetext>&lt;rdar://problem/14874010&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>922749</commentid>
    <comment_count>2</comment_count>
      <attachid>210051</attachid>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2013-08-29 17:08:20 -0700</bug_when>
    <thetext>Created attachment 210051
Fixes the bug</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>922752</commentid>
    <comment_count>3</comment_count>
      <attachid>210051</attachid>
    <who name="Darin Adler">darin</who>
    <bug_when>2013-08-29 17:13:47 -0700</bug_when>
    <thetext>Comment on attachment 210051
Fixes the bug

This seems OK, but I’m really surprised that attached() is the right check to make here. I guess the option elements don’t themselves have renderers? In most cases like this I think we’d check renderer() to see if it’s non-zero.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>922759</commentid>
    <comment_count>4</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2013-08-29 17:25:30 -0700</bug_when>
    <thetext>+geoff

It&apos;s sad that we can&apos;t test for the number of leaked documents in WebKit reliably but we can in Blink.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>922760</commentid>
    <comment_count>5</comment_count>
    <who name="Ryosuke Niwa">rniwa</who>
    <bug_when>2013-08-29 17:26:03 -0700</bug_when>
    <thetext>Committed r154859: &lt;http://trac.webkit.org/changeset/154859&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>924449</commentid>
    <comment_count>6</comment_count>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2013-09-04 08:44:06 -0700</bug_when>
    <thetext>&gt; It&apos;s sad that we can&apos;t test for the number of leaked documents in WebKit reliably but we can in Blink.

It&apos;s trivial to count the number of live documents. Not sure what you mean by this.</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>210051</attachid>
            <date>2013-08-29 17:08:20 -0700</date>
            <delta_ts>2013-08-29 17:13:47 -0700</delta_ts>
            <desc>Fixes the bug</desc>
            <filename>bug-120501-20130829170820.patch</filename>
            <type>text/plain</type>
            <size>3208</size>
            <attacher name="Ryosuke Niwa">rniwa</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi
Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE1NDg1NSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n
ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI0IEBACisyMDEzLTA4LTI5ICBSeW9zdWtl
IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIEF2b2lkIE5vZGUgcmVmZXJlbmNl
cyBmcm9tIEFYT2JqZWN0Q2FjaGUgZnJvbSBsZWFraW5nCisgICAgICAgIGh0dHBzOi8vYnVncy53
ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMjA1MDEKKworICAgICAgICBSZXZpZXdlZCBieSBO
T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBNZXJnZSBodHRwczovL2Nocm9taXVtLmdvb2dsZXNv
dXJjZS5jb20vY2hyb21pdW0vYmxpbmsvKy80NTRmMzE0OTc2MTNiNmQwZmJjZmIwZGY3NTcyNTRi
NjRhMTc3YzA2CisgICAgICAgIHdpdGhvdXQgYW55IHRlc3RzIHNpbmNlIHdlIGRvbid0IGhhdmUg
dGhlIHNhbWUgaW5mcmFzdHJ1Y3R1cmUgdG8gZGV0ZWN0IGxlYWtzIGluIFdlYktpdC4KKworICAg
ICAgICBBIHJlYWwgd29ybGQgZXhhbXBsZSBvZiB0aGlzIHdvdWxkIGJlIHNlbGVjdGluZyBhbiA8
b3B0aW9uPiBpdGVtIGluc2lkZSBmcmFtZSBieSBrZXlib2FyZC4gVGhlIG5vZGUgd2lsbCBub3Qg
YmUgZGVyZWYoKS1lZCB1bnRpbCB0aGUgdG9wRG9jdW1lbnQoKSBpcyBkZXRhY2hlZC4gCisKKyAg
ICAgICAgVGhlIGlzc3VlIHdhcyB0aGF0IEFjY2Vzc2liaWxpdHlNZW51TGlzdE9wdGlvbiBpcyBj
cmVhdGVkIGluIGNoaWxkcmVuQ2hhbmdlZCgpCisgICAgICAgIGhvb2sgY2FsbGVkIHdoZW4gaXRz
IFJlbmRlck9iamVjdCBpcyBiZWluZyBkZXN0cm95ZWQuIFRoaXMgcGF0Y2ggbW9kaWZpZXMgQWNj
ZXNzaWJpbGl0eU1lbnVMaXN0UG9wdXAgc28gaXQgd29uJ3QgY3JlYXRlIEFjY2Vzc2liaWxpdHlN
ZW51TGlzdE9wdGlvbiBpZiBpdHMKKyAgICAgICAgZWxlbWVudCBpcyBhbHJlYWR5IGRldGFjaGVk
LgorCisgICAgICAgICogYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5TWVudUxpc3RQb3B1cC5j
cHA6CisgICAgICAgIChXZWJDb3JlOjpBY2Nlc3NpYmlsaXR5TWVudUxpc3RQb3B1cDo6bWVudUxp
c3RPcHRpb25BY2Nlc3NpYmlsaXR5T2JqZWN0KToKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVy
TWVudUxpc3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyTWVudUxpc3Q6OmRpZFVwZGF0
ZUFjdGl2ZU9wdGlvbik6CisKIDIwMTMtMDgtMjkgIENocmlzIEZsZWl6YWNoICA8Y2ZsZWl6YWNo
QGFwcGxlLmNvbT4KIAogICAgICAgICBBWDogQ3Jhc2ggd2hlbiBWb2ljZU92ZXIgcmVmZXJlbmNl
IGEgVGV4dE1hcmtlciBmcm9tIGFuIGlmcmFtZSB0aGF0IGhhcyBiZWVuIHJlbW92ZWQKSW5kZXg6
IFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eU1lbnVMaXN0UG9wdXAu
Y3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJp
bGl0eU1lbnVMaXN0UG9wdXAuY3BwCShyZXZpc2lvbiAxNTQ4NTMpCisrKyBTb3VyY2UvV2ViQ29y
ZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlNZW51TGlzdFBvcHVwLmNwcAkod29ya2luZyBj
b3B5KQpAQCAtNzAsNyArNzAsNyBAQCBib29sIEFjY2Vzc2liaWxpdHlNZW51TGlzdFBvcHVwOjpj
b21wdXRlCiAKIEFjY2Vzc2liaWxpdHlNZW51TGlzdE9wdGlvbiogQWNjZXNzaWJpbGl0eU1lbnVM
aXN0UG9wdXA6Om1lbnVMaXN0T3B0aW9uQWNjZXNzaWJpbGl0eU9iamVjdChIVE1MRWxlbWVudCog
ZWxlbWVudCkgY29uc3QKIHsKLSAgICBpZiAoIWVsZW1lbnQgfHwgIWlzSFRNTE9wdGlvbkVsZW1l
bnQoZWxlbWVudCkpCisgICAgaWYgKCFlbGVtZW50IHx8ICFpc0hUTUxPcHRpb25FbGVtZW50KGVs
ZW1lbnQpIHx8ICFlbGVtZW50LT5hdHRhY2hlZCgpKQogICAgICAgICByZXR1cm4gMDsKIAogICAg
IEFjY2Vzc2liaWxpdHlPYmplY3QqIG9iamVjdCA9IGRvY3VtZW50KCktPmF4T2JqZWN0Q2FjaGUo
KS0+Z2V0T3JDcmVhdGUoTWVudUxpc3RPcHRpb25Sb2xlKTsKSW5kZXg6IFNvdXJjZS9XZWJDb3Jl
L3JlbmRlcmluZy9SZW5kZXJNZW51TGlzdC5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNv
cmUvcmVuZGVyaW5nL1JlbmRlck1lbnVMaXN0LmNwcAkocmV2aXNpb24gMTU0ODUzKQorKysgU291
cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck1lbnVMaXN0LmNwcAkod29ya2luZyBjb3B5KQpA
QCAtMzkyLDEwICszOTIsMTIgQEAgdm9pZCBSZW5kZXJNZW51TGlzdDo6ZGlkVXBkYXRlQWN0aXZl
T3B0aQogICAgIGlmIChsaXN0SW5kZXggPCAwIHx8IGxpc3RJbmRleCA+PSBzdGF0aWNfY2FzdDxp
bnQ+KHNlbGVjdC0+bGlzdEl0ZW1zKCkuc2l6ZSgpKSkKICAgICAgICAgcmV0dXJuOwogCi0gICAg
QVNTRVJUKHNlbGVjdC0+bGlzdEl0ZW1zKClbbGlzdEluZGV4XSk7Ci0KLSAgICBpZiAoQWNjZXNz
aWJpbGl0eU1lbnVMaXN0KiBtZW51TGlzdCA9IHN0YXRpY19jYXN0PEFjY2Vzc2liaWxpdHlNZW51
TGlzdCo+KGRvY3VtZW50KCkuYXhPYmplY3RDYWNoZSgpLT5nZXQodGhpcykpKQotICAgICAgICBt
ZW51TGlzdC0+ZGlkVXBkYXRlQWN0aXZlT3B0aW9uKG9wdGlvbkluZGV4KTsKKyAgICBIVE1MRWxl
bWVudCogbGlzdEl0ZW0gPSBzZWxlY3QtPmxpc3RJdGVtcygpW2xpc3RJbmRleF07CisgICAgQVNT
RVJUKGxpc3RJdGVtKTsKKyAgICBpZiAobGlzdEl0ZW0tPmF0dGFjaGVkKCkpIHsKKyAgICAgICAg
aWYgKEFjY2Vzc2liaWxpdHlNZW51TGlzdCogbWVudUxpc3QgPSBzdGF0aWNfY2FzdDxBY2Nlc3Np
YmlsaXR5TWVudUxpc3QqPihkb2N1bWVudCgpLmF4T2JqZWN0Q2FjaGUoKS0+Z2V0KHRoaXMpKSkK
KyAgICAgICAgICAgIG1lbnVMaXN0LT5kaWRVcGRhdGVBY3RpdmVPcHRpb24ob3B0aW9uSW5kZXgp
OworICAgIH0KIH0KIAogU3RyaW5nIFJlbmRlck1lbnVMaXN0OjppdGVtVGV4dCh1bnNpZ25lZCBs
aXN0SW5kZXgpIGNvbnN0Cg==
</data>
<flag name="review"
          id="232139"
          type_id="1"
          status="+"
          setter="darin"
    />
          </attachment>
      

    </bug>

</bugzilla>