commit 8e596ab565abfa4510bb55561d11cd90257da300
author Joanmarie Diggs <jdiggs@igalia.com> Wed Sep 02 11:25:12 2020
committer Commit Bot <commit-bot@chromium.org> Wed Sep 02 11:25:12 2020
tree 9c903bd02594a08b0bf8b94d96a0ec408ff628c7
parent ea7ea1287136d52fc60750c896a03d0a9a08f239

Prevent check failures in AXSelection resulting from DOM mutations

When AXSelection::Select is called to set the caret in an unfocused
input, FrameSelection::DidSetSelectionDeprecated focuses the node by
default. If this focus event happens to trigger a DOM mutation, the DOM
tree version associated with the selection will not match the version
associated with the document. As a result, when AXSelection::Select
goes to cache the selection range, the DCHECK for this condition in
SelectionTemplate<Strategy>::AssertValid fails.

We can stop this condition from happening by using the same logic in
FrameSelection::SetSelection, namely call SetSelectionDeprecated and
if true, then call DidSetSelectionDeprecated -- but only after we have
cached the selection range.

If instead the DOM mutation is a consequence of the selection itself,
there will be a similar check failures, both for the DOM tree version
and the fact that layout is needed. Therefore, if a layout is pending
immediately after we dispatch the selection start, update the layout,
the AXPositions, and our stored DOM tree and Style versions.

AX-Relnotes: N/A
Change-Id: Ifbd63744d77db10b8895905a130b0b901cad3e0c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2346329
Commit-Queue: Joanmarie Diggs <jdiggs@igalia.com>
Reviewed-by: Yoshifumi Inoue <yosin@chromium.org>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#803824}