Revert "Remove unneeded included child code"

aleventhal · Chromium LUCI CQ · commit c72c93d88dc0 · 2022-02-25T01:07:18.000Z
Original change: CL:3472799 Reason for revert: https://crbug.com/1300458 > Ever since CL:2946971, AXNodeObject::ChildrenChanged() will only > be called on included nodes. That change improved performance, > because it led to much better de-duping of children changed > events in large subtrees. Bug: None Change-Id: Ic9655af317d6e1c77c32ca5e306ad5b753950c07 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3489308 Auto-Submit: Aaron Leventhal <aleventhal@chromium.org> Reviewed-by: Daniel Libby <dlibby@microsoft.com> Commit-Queue: Daniel Libby <dlibby@microsoft.com> Cr-Commit-Position: refs/heads/main@{#974933}
diff --git a/third_party/blink/renderer/modules/accessibility/ax_node_object.cc b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
@@ -4585,9 +4585,26 @@ void AXNodeObject::ChildrenChangedWithCleanLayout() {
   // now layout is clean.
   SetNeedsToUpdateChildren();
 
-  SANITIZER_CHECK(LastKnownIsIncludedInTreeValue())
-      << "Should only fire children changed on included nodes: "
-      << ToString(true, true);
+  // The caller, AXObjectCacheImpl::ChildrenChangedWithCleanLayout(), is only
+  // Between the time that AXObjectCacheImpl::ChildrenChanged() determines
+  // which included parent to use and now, it's possible that the parent will
+  // no longer be ignored. This is rare, but is covered by this test:
+  // external/wpt/accessibility/crashtests/delayed-ignored-change.html/
+  //
+  // If this object is no longer included in the tree, then our parent needs to
+  // recompute its included-in-the-tree children vector. (And if our parent
+  // isn't included in the tree either, it will recursively update its parent
+  // and so on.)
+  //
+  // The first ancestor that's included in the tree will
+  // be the one that actually fires the ChildrenChanged
+  // event notification.
+  if (!LastKnownIsIncludedInTreeValue()) {
+    if (AXObject* ax_parent = CachedParentObject()) {
+      ax_parent->ChildrenChangedWithCleanLayout();
+      return;
+    }
+  }
 
   // TODO(accessibility) Move this up.
   if (!CanHaveChildren())
diff --git a/third_party/blink/web_tests/external/wpt/accessibility/crashtests/delayed-ignored-change.html b/third_party/blink/web_tests/external/wpt/accessibility/crashtests/delayed-ignored-change.html
@@ -0,0 +1,17 @@
+<html class="test-wait">
+<style>
+  body { font-size: x-large; }
+  .hidden { visibility: hidden; }
+</style>
+<rb class="hidden">
+  <textarea></textarea>
+</rb>
+<script>
+document.addEventListener('load', () => {
+  window.requestIdleCallback(() => {
+    document.querySelector('style').remove();
+    document.documentElement.className = '';
+  });
+}, true);
+</script>
+</html>
