M118: [A11y] Update ignored state for radio/checkbox labels correctly

This is a cherry pick of 2 CLs:
CL:4903842 -- original fix
CL:4907948 -- fix for Android test

If the text inside of a label is updating its cached values before
the label does, we could return an incorrect value for the ignored
state of the text. This resulted in radio buttons sometimes not
updating their name after being made visible.

Fixed: 1487553
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Change-Id: I926c7103f40b9cb3de6bb10f96517e8ae5f57ccf
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4908088
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Cr-Commit-Position: refs/branch-heads/5993@{#1056}
Cr-Branched-From: 5113507-refs/heads/main@{#1192594}

content/browser/accessibility/dump_accessibility_tree_browsertest.cc

@@ -2386,6 +2386,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
   RunHtmlTest(FILE_PATH_LITERAL("input-radio-in-menu.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityInputRadioUnhidden) {
+  RunHtmlTest(FILE_PATH_LITERAL("input-radio-unhidden.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityInputRadioWrappedLabel) {
   RunHtmlTest(FILE_PATH_LITERAL("input-radio-wrapped-label.html"));

content/test/content_test_bundle_data.filelist

@@ -3560,6 +3560,8 @@ data/accessibility/html/input-radio-in-menu-expected-mac.txt
 data/accessibility/html/input-radio-in-menu-expected-uia-win.txt
 data/accessibility/html/input-radio-in-menu-expected-win.txt
 data/accessibility/html/input-radio-in-menu.html
+data/accessibility/html/input-radio-unhidden-expected-blink.txt
+data/accessibility/html/input-radio-unhidden.html
 data/accessibility/html/input-radio-wrapped-label-expected-blink.txt
 data/accessibility/html/input-radio-wrapped-label-expected-fuchsia.txt
 data/accessibility/html/input-radio-wrapped-label.html

content/test/data/accessibility/form-controls/img-form-expected-android.txt

@@ -2,6 +2,8 @@ android.webkit.WebView focusable focused scrollable
 ++android.widget.TextView name='Welcome to my example page!'
 ++android.widget.TextView name='Lengthy instructions on filling out the form.'
 ++android.widget.TextView name='Imagine hundreds of nodes that are simple content...'
+++android.widget.TextView name='Enter your name: '
 ++android.widget.EditText clickable editable_text focusable hint='Enter your name:' input_type=1
+++android.widget.TextView name='Enter your email: '
 ++android.widget.EditText clickable editable_text focusable hint='Enter your email:' input_type=209
-++android.widget.Button role_description='button' clickable focusable name='Subscribe!'
+++android.widget.Button role_description='button' clickable focusable name='Subscribe!'

content/test/data/accessibility/form-controls/img-form-expected-blink.txt

@@ -3,11 +3,11 @@ rootWebArea
 ++staticText name='Lengthy instructions on filling out the form.'
 ++staticText name='Imagine hundreds of nodes that are simple content...'
 ++labelText ignored
-++++staticText ignored name='Enter your name: '
+++++staticText name='Enter your name: '
 ++textField name='Enter your name:'
 ++++genericContainer
 ++labelText ignored
-++++staticText ignored name='Enter your email: '
+++++staticText name='Enter your email: '
 ++textField name='Enter your email:'
 ++++genericContainer
 ++button name='Subscribe!'

content/test/data/accessibility/html/input-radio-unhidden-expected-blink.txt

@@ -0,0 +1,28 @@
+rootWebArea name='done'
+++genericContainer ignored
+++++genericContainer ignored
+++++++main
+++++++++group name='These radio buttons will randomly not have a label on Chromium web browsers.'
+++++++++++legend
+++++++++++++staticText name='These radio buttons will randomly not have a label on Chromium web browsers.'
+++++++++++++++inlineTextBox name='These radio buttons will randomly not have a label on Chromium web browsers.'
+++++++++++radioButton name='Apple' checkedState=false
+++++++++++labelText
+++++++++++++staticText name='Apple'
+++++++++++++++inlineTextBox name='Apple'
+++++++++++radioButton name='Banana' checkedState=false
+++++++++++labelText
+++++++++++++staticText name='Banana'
+++++++++++++++inlineTextBox name='Banana'
+++++++++++radioButton name='Cherry' checkedState=false
+++++++++++labelText
+++++++++++++staticText name='Cherry'
+++++++++++++++inlineTextBox name='Cherry'
+++++++++++radioButton name='Durian' checkedState=false
+++++++++++labelText
+++++++++++++staticText name='Durian'
+++++++++++++++inlineTextBox name='Durian'
+++++++++++radioButton name='Eggplant' checkedState=false
+++++++++++labelText
+++++++++++++staticText name='Eggplant'
+++++++++++++++inlineTextBox name='Eggplant'

content/test/data/accessibility/html/input-radio-unhidden.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<!--
+@WAIT-FOR:done
+-->
+<main>
+  <fieldset style="display:none;">
+    <legend>These radio buttons will randomly not have a label on Chromium web browsers.</legend>
+    <input type="radio" name="hiddenRadio" id="apple">
+    <label for="apple"><span>Apple</span></label>
+    <input type="radio" name="hiddenRadio" id="banana">
+    <label for="banana"><span>Banana</span></label>
+    <input type="radio" name="hiddenRadio" id="cherry">
+    <label for="cherry"><span>Cherry</span></label>
+    <input type="radio" name="hiddenRadio" id="durian">
+    <label for="durian"><span>Durian</span></label>
+    <input type="radio" name="hiddenRadio" id="eggplant">
+    <label for="eggplant"><span>Eggplant</span></label>
+  </fieldset>
+</main>
+<script async defer>
+  document.addEventListener('DOMContentLoaded', () => {
+    requestAnimationFrame(() => {
+      requestAnimationFrame(() => {
+        document.querySelector('fieldset').style.display = 'block';
+        document.title = 'done';
+      });
+    })
+  });
+</script>

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -501,12 +501,17 @@ bool AXLayoutObject::ComputeAccessibilityIsIgnored(
     // To save processing, only walk up the ignored objects.
     // This means that other interesting objects inside the <label> will
     // cause the text to be unignored.
+    // TODO(aleventhal) Speed this up by only doing this work inside of a label.
+    // See IsUsedForLabelOrDescription() in upcoming crrev.com/c/4574033.
     AXObject* ancestor = ParentObject();
     while (ancestor && ancestor->AccessibilityIsIgnored()) {
-      if (ancestor->RoleValue() == ax::mojom::blink::Role::kLabelText) {
-        if (ignored_reasons)
-          ignored_reasons->push_back(IgnoredReason(kAXPresentational));
-        return true;
+      if (auto* label = DynamicTo<HTMLLabelElement>(ancestor->GetNode())) {
+        if (AXNodeObject::IsRedundantLabel(label)) {
+          if (ignored_reasons) {
+            ignored_reasons->push_back(IgnoredReason(kAXPresentational));
+          }
+          return true;
+        }
       }
       ancestor = ancestor->ParentObject();
     }

third_party/blink/renderer/modules/accessibility/ax_node_object.h

@@ -148,6 +148,9 @@ class MODULES_EXPORT AXNodeObject : public AXObject {
   AXObject* GetChildFigcaption() const override;
   bool IsDescendantOfLandmarkDisallowedElement() const override;
 
+  // Is a redundant label of a radio button or checkbox.
+  static bool IsRedundantLabel(HTMLLabelElement* label);
+
   // Used to compute kRadioGroupIds, which is only used on Mac.
   // TODO(accessibility) Consider computing on browser side and removing here.
   AXObjectVector RadioButtonsInGroup() const override;
@@ -358,7 +361,6 @@ class MODULES_EXPORT AXNodeObject : public AXObject {
   ax::mojom::blink::Dropeffect ParseDropeffect(String& dropeffect) const;
 
   static bool IsNameFromLabelElement(HTMLElement* control);
-  static bool IsRedundantLabel(HTMLLabelElement* label);
 
 #if BUILDFLAG(IS_ANDROID)
   bool always_load_inline_text_boxes_ = false;