Fix missing content issues

When a node is attached, explicitly ensure the parent
accessible object for it has ChildrenChanged() called for it, rather
than relying on unclear codepaths for this to happen.

This regressed in CL:2399317, which altered deferred the work in
UpdateCacheAfterNodeIsAttached. Previously, side effects from Get()
during dirty layout led to having the parent recompute its children.

R=dmazzoni@chromium.org

Bug: 1141106
Change-Id: I655784f19668b606b02d1d6ac6e30fbf655cc5c6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2567228
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#833395}

third_party/blink/renderer/core/accessibility/ax_object_cache.h

@@ -98,9 +98,10 @@ class CORE_EXPORT AXObjectCache : public GarbageCollected<AXObjectCache> {
   // changed.
   virtual void TextChanged(const LayoutObject*) = 0;
   virtual void DocumentTitleChanged() = 0;
-  // Called when a node has just been attached, so we can make sure we have the
-  // right subclass of AXObject.
+  // Called when a layout tree for a node has just been attached, so we can make
+  // sure we have the right subclass of AXObject.
   virtual void UpdateCacheAfterNodeIsAttached(Node*) = 0;
+  // A DOM node was inserted , but does not necessarily have a layout tree.
   virtual void DidInsertChildrenOfNode(Node*) = 0;
 
   // Returns true if the AXObjectCache cares about this attribute

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -1171,6 +1171,9 @@ void AXObjectCacheImpl::UpdateCacheAfterNodeIsAttachedWithCleanLayout(
   if (!node || !node->isConnected())
     return;
 
+  // Ignore attached nodes that are not elements, including text nodes and
+  // #shadow-root nodes. This matches previous implementations that worked,
+  // but it is not clear if that could potentially lead to missing content.
   Element* element = DynamicTo<Element>(node);
   if (!element)
     return;
@@ -1195,6 +1198,12 @@ void AXObjectCacheImpl::UpdateCacheAfterNodeIsAttachedWithCleanLayout(
   }
 
   MaybeNewRelationTarget(node, Get(node));
+
+  // Even if the node or parent are ignored, an ancestor may need to include
+  // descendants of the attached node, thus ChildrenChangedWithCleanLayout()
+  // must be called. It handles ignored logic, ensuring that the first ancestor
+  // that should have this as a child will be updated.
+  ChildrenChangedWithCleanLayout(LayoutTreeBuilderTraversal::Parent(*node));
 }
 
 void AXObjectCacheImpl::DidInsertChildrenOfNode(Node* node) {

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h

@@ -119,9 +119,10 @@ class MODULES_EXPORT AXObjectCacheImpl
   void TextChangedWithCleanLayout(Node* optional_node, AXObject*);
   void FocusableChangedWithCleanLayout(Element* element);
   void DocumentTitleChanged() override;
-  // Called when a node has just been attached, so we can make sure we have the
-  // right subclass of AXObject.
+  // Called when a layout tree for a node has just been attached, so we can make
+  // sure we have the right subclass of AXObject.
   void UpdateCacheAfterNodeIsAttached(Node*) override;
+  // A DOM node was inserted , but does not necessarily have a layout tree.
   void DidInsertChildrenOfNode(Node*) override;
 
   void HandleAttributeChanged(const QualifiedName& attr_name,