Merge r222790 - [AX] Do not trigger redundant layout on tables.

https://bugs.webkit.org/show_bug.cgi?id=177781
<rdar://problem/34777030>

Reviewed by Antti Koivisto.

Source/WebCore:

RenderTable::forceSectionsRecalc() marks the RenderTable dirty and schedules a layout.
Every time AccessibilityTable asks for the table element (including during construction),
we end up triggering a layout. This call was added (r191357) to ensure RenderTable's m_firstBody is always
up-to-date (in case of anonymous wrapper table renderer). Instead of relying on the m_firstBody,
let's just use the first child to find the table element. The first child always points to a valid
renderer (or nullptr), while m_firstBody is the result of section computation.

Covered by existing tests.

* accessibility/AccessibilityTable.cpp:
(WebCore::AccessibilityTable::tableElement const):

LayoutTests:

* TestExpectations: see webkit.org/b/177799

LayoutTests/ChangeLog

@@ -1,3 +1,13 @@
+2017-10-03  Zalan Bujtas  <zalan@apple.com>
+
+        [AX] Do not trigger redundant layout on tables.
+        https://bugs.webkit.org/show_bug.cgi?id=177781
+        <rdar://problem/34777030>
+
+        Reviewed by Antti Koivisto.
+
+        * TestExpectations: see webkit.org/b/177799
+
 2017-10-03  Daniel Bates  <dabates@apple.com>
 
         [CSP] Check policy before opening a new window to a JavaScript URL

Source/WebCore/ChangeLog

@@ -1,3 +1,23 @@
+2017-10-03  Zalan Bujtas  <zalan@apple.com>
+
+        [AX] Do not trigger redundant layout on tables.
+        https://bugs.webkit.org/show_bug.cgi?id=177781
+        <rdar://problem/34777030>
+
+        Reviewed by Antti Koivisto.
+
+        RenderTable::forceSectionsRecalc() marks the RenderTable dirty and schedules a layout.
+        Every time AccessibilityTable asks for the table element (including during construction),
+        we end up triggering a layout. This call was added (r191357) to ensure RenderTable's m_firstBody is always
+        up-to-date (in case of anonymous wrapper table renderer). Instead of relying on the m_firstBody,
+        let's just use the first child to find the table element. The first child always points to a valid
+        renderer (or nullptr), while m_firstBody is the result of section computation.
+
+        Covered by existing tests.
+
+        * accessibility/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::tableElement const):
+
 2017-10-03  Daniel Bates  <dabates@apple.com>
 
         [CSP] Check policy before opening a new window to a JavaScript URL

Source/WebCore/accessibility/AccessibilityTable.cpp

@@ -100,16 +100,14 @@ HTMLTableElement* AccessibilityTable::tableElement() const
     RenderTable& table = downcast<RenderTable>(*m_renderer);
     if (is<HTMLTableElement>(table.element()))
         return downcast<HTMLTableElement>(table.element());
-
-    table.forceSectionsRecalc();
-
-    // If the table has a display:table-row-group, then the RenderTable does not have a pointer to it's HTMLTableElement.
-    // We can instead find it by asking the firstSection for its parent.
-    RenderTableSection* firstBody = table.firstBody();
-    if (!firstBody || !firstBody->element())
+    // Try to find the table element, when the AccessibilityTable is mapped to an anonymous table renderer.
+    auto* firstChild = table.firstChild();
+    if (!firstChild || !firstChild->node())
         return nullptr;
-
-    return ancestorsOfType<HTMLTableElement>(*(firstBody->element())).first();
+    if (is<HTMLTableElement>(*firstChild->node()))
+        return downcast<HTMLTableElement>(firstChild->node());
+    // FIXME: This might find an unrelated parent table element.
+    return ancestorsOfType<HTMLTableElement>(*(firstChild->node())).first();
 }
 
 bool AccessibilityTable::isDataTable() const