[A11y] Remove subtrees of nodes removed from flat tree.
Create a method called RemoveSubtreeWhenSafe() that removes subtrees as
soon as it is safe to traverse the flat tree, so that there can be no
orphaned objects left in the cache.
Specifically, "when safe" means:
1) If CanSafelyUseFlatTraversal() returns true, do it now (flat
traversal is not forbidden and there are no pending slot assignments
2) Otherwise, do it towards the beginning of a11y's clean layout
processing. This may be later than necessary -- we may consider having
a special callback that occurs as soon as flat traversal is safe.
Bug: none
Cq-Include-Trybots: luci.chrome.try:chromeos-eve-chrome;luci.chromium.try:linux-rel;luci.chromium.try:linux-lacros-rel,fuchsia-x64-accessibility-rel,fuchsia-x64-rel,linux-bfcache-rel,linux-rel
Bug: 1451115
Change-Id: Ifeef4a50213b41e9598645bca2b8cc8a356a5c46
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4605033
Commit-Queue: Chris Harrelson <chrishtr@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1156556}
diff --git a/accessibility/crashtests/removed-from-flat-tree.html b/accessibility/crashtests/removed-from-flat-tree.html
new file mode 100644
index 0000000..2deaf6a
--- /dev/null
+++ b/accessibility/crashtests/removed-from-flat-tree.html
@@ -0,0 +1,3 @@
+<!DOCTYPE html>
+<audio src="foo"></audio>
+<template shadowroot="closed"></template>
