Avoid DCHECK() in NextOnLine(), PreviousOnLine()

Avoid "Check failed: false. We don't support iterating over objects
excluded from the accessibility tree." by using
ParentObjectIncludedInTree() while computing
NextOnLine(), PreviousOnLine().

Bug: 1153437
Change-Id: Iebd58d44912dcf9ac20b3e0e618af3e7b7b56b4f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2576625Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#834692}

content/browser/accessibility/dump_accessibility_tree_browsertest.cc

@@ -2122,6 +2122,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityNavigation) {
   RunHtmlTest(FILE_PATH_LITERAL("navigation.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityNextOnLineCheckFailure) {
+  RunCSSTest(FILE_PATH_LITERAL("next-on-line-check-failure.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityNoscript) {
   RunHtmlTest(FILE_PATH_LITERAL("noscript.html"));
 }

content/test/data/accessibility/css/next-on-line-check-failure-expected-blink.txt

+rootWebArea
+++genericContainer ignored
+++++genericContainer ignored
+++++list
+++++++staticText name='0'
+++++++++inlineTextBox name='0'

content/test/data/accessibility/css/next-on-line-check-failure.html

+<style>
+ul::before { content: counter(section); -webkit-column-count: 65536;}
+</style>
+<script>
+function boom() {
+  let ul = document.createElement('ul');
+  document.documentElement.appendChild(ul);
+}
+window.onload = boom;
+</script>

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -1086,7 +1086,7 @@ static AXObject* NextOnLineInternalNG(const AXObject& ax_object) {
             ax_object.AXObjectCache().GetOrCreate(runner_layout_object))
       return result;
   }
-  if (!ax_object.ParentObject())
+  if (!ax_object.ParentObjectIncludedInTree())
     return nullptr;
   // Returns next object of parent, since next of |ax_object| isn't appeared on
   // line.
@@ -1142,7 +1142,7 @@ AXObject* AXLayoutObject::NextOnLine() const {
     }
 
     if (!result) {
-      AXObject* parent = ParentObject();
+      AXObject* parent = ParentObjectIncludedInTree();
       // Our parent object could have been created based on an ignored inline or
       // inline block spanning multiple lines. We need to ensure that we are
       // really at the end of our parent before attempting to connect to the
@@ -1210,7 +1210,7 @@ static AXObject* PreviousOnLineInlineNG(const AXObject& ax_object) {
     return nullptr;
   // Returns previous object of parent, since next of |ax_object| isn't appeared
   // on line.
-  return ax_object.ParentObject()->PreviousOnLine();
+  return ax_object.ParentObjectIncludedInTree()->PreviousOnLine();
 }
 
 AXObject* AXLayoutObject::PreviousOnLine() const {
@@ -1259,7 +1259,7 @@ AXObject* AXLayoutObject::PreviousOnLine() const {
     }
 
     if (!result) {
-      AXObject* parent = ParentObject();
+      AXObject* parent = ParentObjectIncludedInTree();
       // Our parent object could have been created based on an ignored inline or
       // inline block spanning multiple lines. We need to ensure that we are
       // really at the start of our parent before attempting to connect to the