Fixes the cause of the crash in the new accessibility selection code

Before every call to an accessibility API on the renderer, we were not checking if the layout tree is clean,
but only if the LayoutView of the document object had a clean layout
which is not the same thing.

Change-Id: If8852842aaf4da06bbb8e65ba495b18c46f82b6a
Bug: 133517108
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1601618Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#676445}

third_party/blink/renderer/modules/accessibility/ax_selection.cc

@@ -120,15 +120,6 @@ void AXSelection::ClearCurrentSelection(Document& document) {
 AXSelection AXSelection::FromCurrentSelection(
     const Document& document,
     const AXSelectionBehavior selection_behavior) {
-  // Previously, retrieving the selection would cause the layout to become
-  // clean, because we were using a deprecated function for retrieving the
-  // selection from the DOM tree,
-  // FrameSelection::ComputeVisibleSelectionInDOMTreeDeprecated. The layout
-  // should not be dirty in the first place, but somehow it is. While we are
-  // investigating the reasons behind this, the workaround is to restore the
-  // previous behavior by forcing the layout to  clean.
-  // TODO(nektar): Remove the following line at the earliest opportunity.
-  const_cast<Document&>(document).UpdateStyleAndLayout();
   const LocalFrame* frame = document.GetFrame();
   if (!frame)
     return {};

third_party/blink/renderer/modules/exported/web_ax_object.cc

@@ -127,6 +127,8 @@ class ScopedActionAnnotator {
 static bool IsLayoutClean(Document* document) {
   if (!document || !document->View())
     return false;
+  if (document->NeedsLayoutTreeUpdate())
+    return false;
   if (document->View()->NeedsLayout())
     return false;
   DocumentLifecycle::LifecycleState state = document->Lifecycle().GetState();