Do not retrieve document markers when distribution for flat tree traversal is dirty

This is a speculative fix which I wasn't able to test, but which will hopefully
resolved the attached bug.

Retrieving the document markers for an AXInlineTextBox requires access to the flattened representation of the DOM tree.
To get this representation, all slots in related shadow DOM subtrees need to be filled in, A.K.A.
 Document::UpdateDistributionForFlatTreeTraversal() needs to be called.
In fact, if accessibility doesn't call this method, it is automatically called by the DOM Position class when accessibility requests for a
DOM Position to be converted to the equivalent position in flat tree.
To prevent a potential infinite loop, we return early when slots in the shadow DOM are dirty.
An infinite loop might occur because updating the distribution for the flat tree could in turn update the accessibility tree
which could in turn call GetDocumentMarkers again.

AX-Relnotes: n/a.

R=dmazzoni@chromium.org, aleventhal@chromium.org

Bug: 1124683
Change-Id: I5f373459f2a4879df4b9754f64c465e7f2b6536d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2464910
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#816184}

third_party/blink/renderer/modules/accessibility/ax_inline_text_box.cc

@@ -239,6 +239,16 @@ void AXInlineTextBox::GetDocumentMarkers(
     Vector<AXRange>* marker_ranges) const {
   if (IsDetached())
     return;
+  if (!GetDocument() ||
+      GetDocument()->IsSlotAssignmentOrLegacyDistributionDirty()) {
+    // In order to retrieve the document markers we need access to the flat
+    // tree. If the slot assignments in a shadow DOM subtree are dirty,
+    // accessing the flat tree will cause them to be updated, which could in
+    // turn cause an update to the accessibility tree, potentially causing this
+    // method to be called repeatedly.
+    return;  // Wait until distribution for flat tree traversal has been
+             // updated.
+  }
 
   int text_length = TextLength();
   if (!text_length)