Only the top document has its own AXObjectCache, so Document::detach doesn't need to call clearAXObjectCache when the document being detached is not the top. This is needlessly causing the whole accessibility tree to be regenerated every time an iframe on a page reloads.
Created attachment 108801 [details] Patch
Comment on attachment 108801 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=108801&action=review > Source/WebCore/dom/Document.cpp:1830 > + this has the ability to leak objects that came from an iframe until the whole document is cleared, does it not? > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:53 > + document.getElementById("console").innerText += "\nBefore:\n"; wrong indentation. > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:56 > + // Remove the iframe. wrong indentation. > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:64 > + document.getElementById("console").innerText += "\nAfter:\n"; wrong indentation. > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:66 > + document.getElementById("console").innerText += "\n"; wrong indentation. > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:69 > + // are now invalid - they've been deleted. wrong indentation. > LayoutTests/accessibility/deleting-iframe-destroys-axcache.html:74 > + // Make sure that the other nodes are unchanged. wrong indentation.
(In reply to comment #2) > (From update of attachment 108801 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=108801&action=review > > > Source/WebCore/dom/Document.cpp:1830 > > + > > this has the ability to leak objects that came from an iframe until the whole document is cleared, does it not? No, in the case where the iframe is actually deleted like this, I'm positive that AXObjectCache::remove is actually called on all of the accessibility objects within the iframe's tree. The objects are deleted when their reference count hits zero. The test already confirms this by checking that the objects have lost their correct role, but I added my own debug logging to confirm it. If there is any scenario where an iframe is detached but not either deleted or reattached somewhere else in the same page, then we could have a problem - but I can't think of any such circumstance.
Created attachment 108856 [details] Patch
Comment on attachment 108856 [details] Patch looks good. r=me
Comment on attachment 108856 [details] Patch Clearing flags on attachment: 108856 Committed r96127: <http://trac.webkit.org/changeset/96127>
All reviewed patches have been landed. Closing bug.