[A11y] Simplification -- don't create tree holes for layout updates
When the layout tree changes, invalidate the related a11y subtree
completely.
This removes one more call site for RepairChildrenOfIncludedParent(),
leaving only one caller remaining, which we hope to remove in a
follow-up.
Also fixes a bug, where the descendants of a textarea were missing
a parent.
Fixed: 1503069
Change-Id: If2176b5d013a0c2e0ecbd581a99ac45e4619ceda
Cq-Do-Not-Cancel-Tryjobs: true
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4995912
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1234765}
diff --git a/accessibility/crashtests/animated-textarea.html b/accessibility/crashtests/animated-textarea.html
new file mode 100644
index 0000000..a23eed6
--- /dev/null
+++ b/accessibility/crashtests/animated-textarea.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<!-- This tests that the anonymous descendants of the textarea do not lose
+ their attachment to parent objects -->
+<html class="test-wait">
+<canvas>
+<textarea>
+</textarea>
+<script>
+const canvas = document.querySelector('canvas');
+const animation = canvas.animate([
+ {"listStylePosition":"outside"}, {"listStylePosition":"inside"}],
+ {"duration":100,"delay":0});
+animation.addEventListener('finish', () => {
+ document.documentElement.className = '';
+});
+</script>
+</canvas>
