Fix crashes with a11y in embedded youtube

It is safe to access layout after a call to HandleLayoutComplete(), and
it should be done as soon as possible.

Exactly what leads to the fatal errors should still be investigated
anyway, but this is a simple fix and we still a way to repro.

Bug: 1131848,1125186
Change-Id: Ia529928fdee731f9fcf81d65a80edb49aadee9fe
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2436418
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#811553}

third_party/blink/renderer/modules/accessibility/ax_object.cc

@@ -1337,7 +1337,7 @@ void AXObject::UpdateCachedAttributeValuesIfNeeded() const {
 
 #if DCHECK_IS_ON()  // Required in order to get Lifecycle().ToString()
   DCHECK(!GetDocument() || GetDocument()->Lifecycle().GetState() >=
-                               DocumentLifecycle::kLayoutClean)
+                               DocumentLifecycle::kAfterPerformLayout)
       << "Unclean document at lifecycle "
       << GetDocument()->Lifecycle().ToString();
 #endif

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -532,7 +532,8 @@ AXObject* AXObjectCacheImpl::GetOrCreate(Node* node) {
 #if DCHECK_IS_ON()
   Document* document = &node->GetDocument();
   DCHECK(document);
-  DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
+  DCHECK(document->Lifecycle().GetState() >=
+         DocumentLifecycle::kAfterPerformLayout)
       << "Unclean document at lifecycle " << document->Lifecycle().ToString();
 #endif  // DCHECK_IS_ON()
 
@@ -574,7 +575,8 @@ AXObject* AXObjectCacheImpl::GetOrCreate(LayoutObject* layout_object) {
 #if DCHECK_IS_ON()
   Document* document = &layout_object->GetDocument();
   DCHECK(document);
-  DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
+  DCHECK(document->Lifecycle().GetState() >=
+         DocumentLifecycle::kAfterPerformLayout)
       << "Unclean document at lifecycle " << document->Lifecycle().ToString();
 #endif  // DCHECK_IS_ON()
 
@@ -2369,21 +2371,14 @@ void AXObjectCacheImpl::HandleLoadCompleteWithCleanLayout(Node* document_node) {
 
 void AXObjectCacheImpl::HandleLayoutComplete(Document* document) {
   SCOPED_DISALLOW_LIFECYCLE_TRANSITION(*document);
-  DeferTreeUpdate(&AXObjectCacheImpl::HandleLayoutCompleteWithCleanLayout,
-                  document);
-}
-
-void AXObjectCacheImpl::HandleLayoutCompleteWithCleanLayout(
-    Node* document_node) {
-  DCHECK(document_node);
-  DCHECK(IsA<Document>(document_node));
-#if DCHECK_IS_ON()
-  Document* document = To<Document>(document_node);
-  DCHECK(document->Lifecycle().GetState() >= DocumentLifecycle::kLayoutClean)
-      << "Unclean document at lifecycle " << document->Lifecycle().ToString();
-#endif  // DCHECK_IS_ON()
-  PostNotification(GetOrCreate(document_node),
-                   ax::mojom::blink::Event::kLayoutComplete);
+  if (document->Lifecycle().GetState() >=
+      DocumentLifecycle::kAfterPerformLayout) {
+    PostNotification(GetOrCreate(document),
+                     ax::mojom::blink::Event::kLayoutComplete);
+  } else {
+    DeferTreeUpdate(&AXObjectCacheImpl::EnsurePostNotification, document,
+                    ax::mojom::blink::Event::kLayoutComplete);
+  }
 }
 
 void AXObjectCacheImpl::HandleScrolledToAnchor(const Node* anchor_node) {

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.h

@@ -210,7 +210,6 @@ class MODULES_EXPORT AXObjectCacheImpl
   void HandleAriaSelectedChangedWithCleanLayout(Node*);
   void HandleNodeLostFocusWithCleanLayout(Node*);
   void HandleNodeGainedFocusWithCleanLayout(Node*);
-  void HandleLayoutCompleteWithCleanLayout(Node*);
   void HandleLoadCompleteWithCleanLayout(Node*);
   void UpdateCacheAfterNodeIsAttachedWithCleanLayout(Node*);
   void DidShowMenuListPopupWithCleanLayout(Node*);