RESOLVED FIXED 120501
Avoid Node references from AXObjectCache from leaking 
https://bugs.webkit.org/show_bug.cgi?id=120501
Summary Avoid Node references from AXObjectCache from leaking
Ryosuke Niwa
Reported 2013-08-29 16:38:25 PDT
Merge https://chromium.googlesource.com/chromium/blink/+/454f31497613b6d0fbcfb0df757254b64a177c06 A real world example of this would be selecting an <option> item inside frame by keyboard. The node will not be deref()-ed until the topDocument() is detached. The issue was that AccessibilityMenuListOption is created in childrenChanged() hook called when its RenderObject is being destroyed. This patch modifies AccessibilityMenuListPopup so it won't create AccessibilityMenuListOption if its element is already detached.
Attachments
Fixes the bug (3.13 KB, patch)
2013-08-29 17:08 PDT, Ryosuke Niwa 		darin: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2013-08-29 16:38:36 PDT
<rdar://problem/14874010>
Ryosuke Niwa
Comment 2 2013-08-29 17:08:20 PDT
Created attachment 210051 [details] Fixes the bug
Darin Adler
Comment 3 2013-08-29 17:13:47 PDT
Comment on attachment 210051 [details] Fixes the bug This seems OK, but I’m really surprised that attached() is the right check to make here. I guess the option elements don’t themselves have renderers? In most cases like this I think we’d check renderer() to see if it’s non-zero.
Ryosuke Niwa
Comment 4 2013-08-29 17:25:30 PDT
+geoff It's sad that we can't test for the number of leaked documents in WebKit reliably but we can in Blink.
Ryosuke Niwa
Comment 5 2013-08-29 17:26:03 PDT
Committed r154859: <http://trac.webkit.org/changeset/154859>
Geoffrey Garen
Comment 6 2013-09-04 08:44:06 PDT
> It's sad that we can't test for the number of leaked documents in WebKit reliably but we can in Blink. It's trivial to count the number of live documents. Not sure what you mean by this.
Note You need to log in before you can comment on or make changes to this bug.