Cherry-pick 523acc3. rdar://problem/100245048

    AX: AXIsolatedTree::updateChildren doesn't propagate updates downwards when AccessibilityObject::m_subtreeDirty is true
    https://bugs.webkit.org/show_bug.cgi?id=245694
    rdar://100245048

    Reviewed by Chris Fleizach.

    When AXIsolatedTree::updateChildren updates the children of the nearest in-isolated-tree
    ancestor to the parameter object, it compares the new children of that object to the "old"
    ones, i.e. the children for that object in the nodemap. If we found that the object's new children
    included an object that already existed in the old nodemap children, we do nothing (besides
    deliberately not queuing it for deletion).

    Based on the update pattern of some sites, doing nothing in this scenario is not right, since this
    existing object could have m_subtreeDirty set, meaning we need to propagate descendant updates downwards.
    This is exactly what the live tree does in AccessibilityObject::insertChild.

    With this patch, we detect m_subtreeDirty in this scenario and propagate that update downwards with
    AXIsolatedTree::collectNodeChangesForSubtree.

    Fixes accessibility/text-alternative-calculation-from-listbox.html which is dependent on m_subtreeDirty
    updates being handled properly.

    * LayoutTests/accessibility-isolated-tree/TestExpectations:
    * Source/WebCore/accessibility/AccessibilityObject.h:
    (WebCore::AccessibilityObject::hasDirtySubtree const): Added.
    * Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp:
    (WebCore::AXIsolatedTree::updateChildren):

    Canonical link: https://commits.webkit.org/254899@main

Canonical link: https://commits.webkit.org/252432.473@safari-7614.2.9.1-branch

LayoutTests/accessibility-isolated-tree/TestExpectations

@@ -68,7 +68,6 @@ accessibility/select-element-at-index.html [ Failure ]
 accessibility/set-value-not-work-for-disabled-sliders.html [ Failure ]
 accessibility/slider-with-lost-renderer.html [ Failure ]
 accessibility/svg-remote-element.html [ Failure ]
-accessibility/text-alternative-calculation-from-listbox.html [ Failure ]
 accessibility/textarea-insertion-point-line-number.html [ Failure ]
 accessibility/title-ui-element-correctness.html [ Failure ]
 accessibility/text-alternative-calculation-hidden-nodes.html [ Failure ]

Source/WebCore/accessibility/AccessibilityObject.h

@@ -98,6 +98,8 @@ class AccessibilityObject : public AXCoreObject, public CanMakeWeakPtr<Accessibi
     bool hasAncestorMatchingFlag(AXAncestorFlag) const;
     bool matchesAncestorFlag(AXAncestorFlag) const;
 
+    bool hasDirtySubtree() const { return m_subtreeDirty; }
+
     bool hasDocumentRoleAncestor() const override;
     bool hasWebApplicationAncestor() const override;
     bool isInDescriptionListDetail() const override;

Source/WebCore/accessibility/isolatedtree/AXIsolatedTree.cpp

@@ -587,8 +587,14 @@ void AXIsolatedTree::updateChildren(AccessibilityObject& axObject, ResolveNodeCh
         ASSERT(newChildren[i]->objectID() == newChildrenIDs[i]);
         ASSERT(newChildrenIDs[i].isValid());
         size_t index = oldChildrenIDs.find(newChildrenIDs[i]);
-        if (index != notFound)
+        if (index != notFound) {
+            // Prevent deletion of this object below by removing it from oldChildrenIDs.
             oldChildrenIDs.remove(index);
+
+            // Propagate any subtree updates downwards for this already-existing child.
+            if (auto* liveChild = dynamicDowncast<AccessibilityObject>(newChildren[i].get()); liveChild && liveChild->hasDirtySubtree())
+                collectNodeChangesForSubtree(*liveChild);
+        }
         else {
             // This is a new child, add it to the tree.
             AXLOG(makeString("AXID ", axAncestor->objectID().loggingString(), " gaining new subtree, starting at ID ", newChildren[i]->objectID().loggingString(), ":"));