When updating a subtree of the IsolatedTree, first remove the entire subtree, not just the subtree root.
Created attachment 390764 [details] Patch
Comment on attachment 390764 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=390764&action=review > Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:215 > + ASSERT(m_readerThreadNodeMap.get(item.m_isolatedObject->objectID())->refCount() == 2); can you add a comment why refCount must be two here
Created attachment 390775 [details] Patch
Comment on attachment 390775 [details] Patch Clearing flags on attachment: 390775 Committed r256630: <https://trac.webkit.org/changeset/256630>
All reviewed patches have been landed. Closing bug.
<rdar://problem/59465611>