Detached nodes must be ignored, not included in tree

This fix ensures that detached objects are never considered as
included in the tree.

Explanation:
Sometimes a node is detached in the middle of the tree. For example,
this can occur when a combobox popup closes its popup. Currently, when
a node is detached in the middle of the tree, the parent hierarchy may
not be immediately repaired, to skip over the old detached object,
which can cause anything using ParentObjectIncludedInTree() to reach
a detached object, which is not actually included in the tree.
Normally the parent hierarchy will be repaired the next time the
detached object's parent's children are requested.

An alternate fix would be to, immediately when a node is detached,
ensure that the parent hierarchy is always repaired when nodes are
detached in the middle of the hierarchy. However, care would need to
be taken to avoid extra work when an entire document or subtree is
being removed.

Bug: 1167459
Change-Id: If374617f451992c1f68607dc9b3c56bc0f0908c4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2638395Reviewed-by: Alice Boxhall <aboxhall@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#845135}

third_party/blink/renderer/modules/accessibility/ax_object.cc

@@ -1685,8 +1685,11 @@ bool AXObject::AccessibilityIsIncludedInTree() const {
 
 void AXObject::UpdateCachedAttributeValuesIfNeeded(
     bool notify_parent_of_ignored_changes) const {
-  if (IsDetached())
+  if (IsDetached()) {
+    cached_is_ignored_ = true;
+    cached_is_ignored_but_included_in_tree_ = false;
     return;
+  }
 
   AXObjectCacheImpl& cache = AXObjectCache();
 

third_party/blink/renderer/modules/accessibility/ax_object_test.cc

@@ -40,6 +40,22 @@ TEST_F(AccessibilityTest, IsAncestorOf) {
   EXPECT_FALSE(button->IsAncestorOf(*root));
 }
 
+TEST_F(AccessibilityTest, DetachedIsIgnored) {
+  SetBodyInnerHTML(R"HTML(<button id="button">button</button>)HTML");
+
+  const AXObject* root = GetAXRootObject();
+  ASSERT_NE(nullptr, root);
+  AXObject* button = GetAXObjectByElementId("button");
+  ASSERT_NE(nullptr, button);
+
+  EXPECT_FALSE(button->IsDetached());
+  EXPECT_FALSE(button->AccessibilityIsIgnored());
+  GetAXObjectCache().Remove(button->GetNode());
+  EXPECT_TRUE(button->IsDetached());
+  EXPECT_TRUE(button->AccessibilityIsIgnored());
+  EXPECT_FALSE(button->AccessibilityIsIgnoredButIncludedInTree());
+}
+
 TEST_F(AccessibilityTest, UnignoredChildren) {
   SetBodyInnerHTML(R"HTML(This is a test with
                    <p role="presentation">