Adding aria-haspopup later must affect CanHaveChildren

Invalidate the object when aria-haspopup changes.

Explanation:

The cached native_role_ value, which is computed from
NativeAccessibilityRoleIgnoringAria(), must not return a different
result depending on whether aria-haspopup changes before/after the
caching.

This affects CanHaveChildren() for a button that changes its
aria-haspopup value. This in turn affects many other things for the
button, such such as aria-activedescendant computation.

Bug: 879032
Change-Id: I2b929623f7dfbc0ba926088add4d747af1f77ef7
Reviewed-on: https://chromium-review.googlesource.com/1196864
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#587870}

third_party/WebKit/LayoutTests/accessibility/aom-string-properties.html

@@ -69,6 +69,9 @@ test(function(t) {
     var axNode = accessibilityController.accessibleElementById("hasPopUp");
     assert_equals(axNode.hasPopup, "");
     node.accessibleNode.hasPopUp = "dialog";
+    // Refresh the axNode as aria-haspopup changes can invalidate it for
+    // purposes of allowing the role change.
+    axNode = accessibilityController.accessibleElementById("hasPopUp");
     assert_equals(axNode.hasPopup, "dialog");
 }, "AccessibleNode.hasPopUp");
 </script>

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -306,7 +306,7 @@ AccessibilityRole AXLayoutObject::NativeAccessibilityRoleIgnoringAria() const {
     if (node && node->IsLink())
       return kImageMapRole;
     if (IsHTMLInputElement(node))
-      return HasPopup() ? kPopUpButtonRole : kButtonRole;
+      return ButtonRoleType();
     if (IsSVGImage())
       return kSVGRootRole;
 

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -284,6 +284,12 @@ bool AXNodeObject::IsDescendantOfElementType(
   return false;
 }
 
+// TODO(accessibility) Needs a new name as it does check ARIA, including
+// checking the @role for an iframe, and @aria-haspopup/aria-pressed via
+// ButtonType().
+// TODO(accessibility) This value is cached in native_role_ so it needs to
+// be recached if anything it depends on change, such as IsClickable(),
+// DataList(), aria-pressed, the parent's tag, role on an iframe, etc.
 AccessibilityRole AXNodeObject::NativeAccessibilityRoleIgnoringAria() const {
   if (!GetNode())
     return kUnknownRole;

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -961,7 +961,8 @@ void AXObjectCacheImpl::HandlePossibleRoleChange(Node* node) {
 
 void AXObjectCacheImpl::HandleAttributeChanged(const QualifiedName& attr_name,
                                                Element* element) {
-  if (attr_name == roleAttr || attr_name == typeAttr || attr_name == sizeAttr)
+  if (attr_name == roleAttr || attr_name == typeAttr || attr_name == sizeAttr ||
+      attr_name == aria_haspopupAttr)
     HandlePossibleRoleChange(element);
   else if (attr_name == altAttr || attr_name == titleAttr)
     TextChanged(element);