M118 minibranch: Make MarkDocumentDirty() operate at safe time

This is a partial cherry pick of crrev.com/c/4852930.
It only takes the part that ensures MarkDocumentDirty() performs all work at a safe time. (The image annotation part of that CL had
caused crbug.com/1482478, which we want to avoid in this cherry pick).

(cherry picked from commit ccb31ab)

(cherry picked from commit 52d9436)

Fixed: 1480675, b/305236511, b/305967411, 1493459
Change-Id: I80d3fd25600eaef3822c4039ac053fa554c1f1d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4852930
Reviewed-by: Chris Harrelson <chrishtr@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Original-Original-Commit-Position: refs/heads/main@{#1195084}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4951970
Reviewed-by: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Cr-Original-Commit-Position: refs/branch-heads/5993@{#1334}
Cr-Original-Branched-From: 5113507-refs/heads/main@{#1192594}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4950032
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/5993_88@{#5}
Cr-Branched-From: 1d05652-refs/branch-heads/5993@{#1298}
Cr-Branched-From: 5113507-refs/heads/main@{#1192594}

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -4222,15 +4222,6 @@ void AXObjectCacheImpl::MarkAXSubtreeDirty(AXObject* obj) {
 void AXObjectCacheImpl::MarkDocumentDirty() {
   CHECK(!IsFrozen());
   mark_all_dirty_ = true;
-  // Assume all nodes in the tree need to recompute their properties.
-  // Note that objects can remain in the tree without being re-created.
-  // However, they will be dropped if they are no longer needed as the tree
-  // structure is rebuilt from the top down.
-  for (auto& entry : objects_) {
-    AXObject* object = entry.value;
-    DCHECK(!object->IsDetached());
-    object->InvalidateCachedValues();
-  }
 
   ScheduleAXUpdate();
 }
@@ -4241,6 +4232,16 @@ void AXObjectCacheImpl::MarkDocumentDirtyWithCleanLayout() {
   // position in the content.
   DCHECK(mark_all_dirty_);
 
+  // Assume all nodes in the tree need to recompute their properties.
+  // Note that objects can remain in the tree without being re-created.
+  // However, they will be dropped if they are no longer needed as the tree
+  // structure is rebuilt from the top down.
+  for (auto& entry : objects_) {
+    AXObject* object = entry.value;
+    DCHECK(!object->IsDetached());
+    object->InvalidateCachedValues();
+  }
+
   // Don't keep previous parent-child relationships.
   // This loop operates on a copy of values in the objects_ map, because some
   // entries may be removed from objects_ while iterating.