GitLab

When an object that is aria-owned by another object is re-parented as a layout object
we remove any aria-owned children mappings it may have in the AXRelationCache,
in addition to the mapping to its aria-owning parent.
However, we don't remove any mappings from its parent to the removed object from the AXRelationCache.
After the children of its parent will have been marked as requiring an update, the AXRelationCache will try and unmap the parent's existing owned children before adding the new ones.
During the unmap process, we check if any of the previous children are already owned by another object, in order to skip removing them from the cache if so.
However, we forget to check whether any of the previous children has been removed from the cached because it has been re-parented and
its AxID has been re-used because its the same DOM node that has been provided with a layout object.

R=dmazzoni@chromium.org, aleventhal@chromium.org

Bug: 934529
Change-Id: I298d396987f444d061a2f2324580726e987a739b
Reviewed-on: https://chromium-review.googlesource.com/c/1485064Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#635187}