Merge https://chromium.googlesource.com/chromium/blink/+/454f31497613b6d0fbcfb0df757254b64a177c06 A real world example of this would be selecting an <option> item inside frame by keyboard. The node will not be deref()-ed until the topDocument() is detached. The issue was that AccessibilityMenuListOption is created in childrenChanged() hook called when its RenderObject is being destroyed. This patch modifies AccessibilityMenuListPopup so it won't create AccessibilityMenuListOption if its element is already detached.
<rdar://problem/14874010>
Created attachment 210051 [details] Fixes the bug
Comment on attachment 210051 [details] Fixes the bug This seems OK, but I’m really surprised that attached() is the right check to make here. I guess the option elements don’t themselves have renderers? In most cases like this I think we’d check renderer() to see if it’s non-zero.
+geoff It's sad that we can't test for the number of leaked documents in WebKit reliably but we can in Blink.
Committed r154859: <http://trac.webkit.org/changeset/154859>
> It's sad that we can't test for the number of leaked documents in WebKit reliably but we can in Blink. It's trivial to count the number of live documents. Not sure what you mean by this.