Reland: Ensure children changed in new input type=search

What's happening is that as the search field goes from empty to having
text, the shadow generic container inside of the input goes from not
being in the tree to being in the tree. But in
AXNodeObject::ChildrenChanged(), we use LastKnownIsIncludedInTree() and
we can't update it to a new value. So we think it's still not included
in the tree, and update the parent's children. But we also need to
update its children too.

Originally backed out because it was suspected to be related to test
timeouts here:
https://ci.chromium.org/p/chromium/builders/ci/WebKit%20Win10/76067

Relanding so that we can prove it one way or another. I suspect it
was not related.

NOTRY=true

Bug: 1146214
Change-Id: Idb814ec95f6f04460dda81439b164e214a7ef14e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2533157Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#826330}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -3846,10 +3846,20 @@ void AXNodeObject::ChildrenChanged() {
   // because unignored nodes recursively include all children of ignored
   // nodes. This method is called during layout, so we need to be careful to
   // only explore existing objects.
-  AXObject* node_to_update =
-      LastKnownIsIncludedInTreeValue() ? this : ParentObjectIncludedInTree();
-  if (node_to_update)  // Can be null, e.g. if <title> contents change.
-    node_to_update->SetNeedsToUpdateChildren();
+  if (!LastKnownIsIncludedInTreeValue()) {
+    // The first object (this or ancestor) that is included in the tree is the
+    // one whose children may have changed.
+    // Can be null, e.g. if <title> contents change
+    if (ParentObjectIncludedInTree())
+      ParentObjectIncludedInTree()->SetNeedsToUpdateChildren();
+  }
+
+  // Also update the current object, in case it wasn't included in the tree but
+  // now is. In that case, the LastKnownIsIncludedInTreeValue() won't have been
+  // updated yet, so we can't use that. Unfortunately, this is not a safe time
+  // to get the current included in tree value, therefore, we'll play it safe
+  // and update the children in two places sometimes.
+  SetNeedsToUpdateChildren();
 
   // If this node's children are not part of the accessibility tree then
   // skip notification and walking up the ancestors.