Ensure that AddChildren() is called with clean layout

Bug: 1091178
Change-Id: Ia6e82b1fcab8f08dbb3dff6186a8ab04e5a4f127
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2376307
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#802277}

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -148,8 +148,11 @@ AXObjectCacheImpl::AXObjectCacheImpl(Document& document)
   if (document_->LoadEventFinished())
     AddPermissionStatusListener();
   documents_.insert(&document);
-  relation_cache_->Init();
   use_ax_menu_list_ = GetSettings()->GetUseAXMenuList();
+
+  // Perform last, to ensure AXObjectCacheImpl() is fully set up, as
+  // AXRelationCache() sometimes calls back into AXObjectCacheImpl.
+  relation_cache_->Init();
 }
 
 AXObjectCacheImpl::~AXObjectCacheImpl() {

third_party/blink/renderer/modules/accessibility/ax_object_test.cc

@@ -679,21 +679,17 @@ TEST_F(AccessibilityTest, CheckNoDuplicateChildren) {
       ax_select->FirstChildIncludingIgnored()->ChildCountIncludingIgnored(), 1);
 }
 
-TEST_F(AccessibilityTest, InitRelationCache) {
-  // All of the other tests already have accessibility initialized
+TEST_F(AccessibilityTest, InitRelationCacheLabelFor) {
+  // Most other tests already have accessibility initialized
   // first, but we don't want to in this test.
   //
   // Get rid of the AXContext so the AXObjectCache is destroyed.
   ax_context_.reset(nullptr);
 
   SetBodyInnerHTML(R"HTML(
-      <ul id="ul" aria-owns="li"></ul>
       <label for="a"></label>
       <input id="a">
       <input id="b">
-      <div role="section" id="div">
-        <li id="li"></li>
-      </div>
     )HTML");
 
   // Now recreate an AXContext, simulating what happens if accessibility
@@ -706,11 +702,32 @@ TEST_F(AccessibilityTest, InitRelationCache) {
   ASSERT_NE(nullptr, input_a);
   const AXObject* input_b = GetAXObjectByElementId("b");
   ASSERT_NE(nullptr, input_b);
+}
+
+TEST_F(AccessibilityTest, InitRelationCacheAriaOwns) {
+  // Most other tests already have accessibility initialized
+  // first, but we don't want to in this test.
+  //
+  // Get rid of the AXContext so the AXObjectCache is destroyed.
+  ax_context_.reset(nullptr);
+
+  SetBodyInnerHTML(R"HTML(
+      <ul id="ul" aria-owns="li"></ul>
+      <div role="section" id="div">
+        <li id="li"></li>
+      </div>
+    )HTML");
+
+  // Now recreate an AXContext, simulating what happens if accessibility
+  // is enabled after the document is loaded.
+  ax_context_.reset(new AXContext(GetDocument()));
+
+  const AXObject* root = GetAXRootObject();
+  ASSERT_NE(nullptr, root);
 
-  EXPECT_TRUE(GetAXObjectCache().MayHaveHTMLLabel(
-      To<HTMLElement>(*input_a->GetNode())));
-  EXPECT_FALSE(GetAXObjectCache().MayHaveHTMLLabel(
-      To<HTMLElement>(*input_b->GetNode())));
+  // Perform deferred processing so that aria-owns children are attached.
+  GetDocument().Lifecycle().AdvanceTo(DocumentLifecycle::kInAccessibility);
+  GetAXObjectCache().ProcessDeferredAccessibilityEvents(GetDocument());
 
   // Note: retrieve the LI first and check that its parent is not
   // the paragraph element. If we were to retrieve the UL element,

third_party/blink/renderer/modules/accessibility/ax_relation_cache.cc

@@ -24,11 +24,13 @@ void AXRelationCache::Init() {
     if (!id.IsEmpty())
       all_previously_seen_label_target_ids_.insert(id);
 
+    // Ensure correct ancestor chains even when not all AXObject's in the
+    // document are created, e.g. in the devtools accessibility panel.
+    // Defers adding aria-owns targets as children of their new parents,
+    // and to the relation cache, until the appropriate document lifecycle.
     if (element.FastHasAttribute(html_names::kAriaOwnsAttr)) {
-      if (AXObject* obj = object_cache_->GetOrCreate(&element)) {
-        obj->ClearChildren();
-        obj->AddChildren();
-      }
+      object_cache_->HandleAttributeChanged(html_names::kAriaOwnsAttr,
+                                            &element);
     }
   }
 }