AXObjectCacheImpl::postNotification shouldn't post on an ancestor.

Source/modules/accessibility/AXObjectCacheImpl.cpp

 /*
  * Copyright (C) 2014, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 629 matching lines @@
     textChanged(getOrCreate(layoutObject));
 }
 
 void AXObjectCacheImpl::textChanged(AXObject* obj)
 {
     if (!obj)
         return;
 
     bool parentAlreadyExists = obj->parentObjectIfExists();
     obj->textChanged();
-    postNotification(obj, obj->document(), AXObjectCacheImpl::AXTextChanged, true);
+    postNotification(obj, AXObjectCacheImpl::AXTextChanged, true);
     if (parentAlreadyExists)
         obj->notifyIfIgnoredValueChanged();
 }
 
 void AXObjectCacheImpl::updateCacheAfterNodeIsAttached(Node* node)
 {
     // Calling get() will update the AX object if we had an AXNodeObject but now we need
     // an AXLayoutObject, because it was reparented to a location outside of a canvas.
     get(node);
 }
@@ skipping 51 matching lines @@
 
     m_notificationsToPost.clear();
 }
 
 void AXObjectCacheImpl::postNotification(LayoutObject* layoutObject, AXNotification notification, bool postToElement)
 {
     if (!layoutObject)
         return;
 
     m_modificationCount++;
-
-    // Get an accessibility object that already exists. One should not be created here
-    // because a layout update may be in progress and creating an AX object can re-trigger a layout
-    RefPtr<AXObject> object = get(layoutObject);
-    while (!object && layoutObject) {
-        layoutObject = layoutObject->parent();
-        object = get(layoutObject);
-    }
-
-    if (!layoutObject)
-        return;
-
-    postNotification(object.get(), &layoutObject->document(), notification, postToElement);
+    postNotification(get(layoutObject), notification, postToElement);
 }
 
 void AXObjectCacheImpl::postNotification(Node* node, AXNotification notification, bool postToElement)
 {
     if (!node)
         return;
 
     m_modificationCount++;
-
-    // Get an accessibility object that already exists. One should not be created here
-    // because a layout update may be in progress and creating an AX object can re-trigger a layout
-    RefPtr<AXObject> object = get(node);
-    while (!object && node) {
-        node = node->parentNode();
-        object = get(node);
-    }
-
-    if (!node)
-        return;
-
-    postNotification(object.get(), &node->document(), notification, postToElement);
+    postNotification(get(node), notification, postToElement);
 }
 
-void AXObjectCacheImpl::postNotification(AXObject* object, Document* document, AXNotification notification, bool postToElement)
+void AXObjectCacheImpl::postNotification(AXObject* object, AXNotification notification, bool postToElement)
 {
     m_modificationCount++;
 
     if (object && !postToElement)
         object = object->observableObject();
 
-    if (!object && document)
-        object = get(document->layoutView());
-
     if (!object)
         return;
 
     m_notificationsToPost.append(std::make_pair(object, notification));
     if (!m_notificationPostTimer.isActive())
         m_notificationPostTimer.startOneShot(0, FROM_HERE);
 }
 
 void AXObjectCacheImpl::checkedStateChanged(Node* node)
 {
@@ skipping 30 matching lines @@
 {
     if (!layoutObject)
         return;
 
     m_modificationCount++;
 
     // Create the AXObject if it didn't yet exist - that's always safe at the end of a layout, and it
     // allows an AX notification to be sent when a page has its first layout, rather than when the
     // document first loads.
     if (AXObject* obj = getOrCreate(layoutObject))
-        postNotification(obj, obj->document(), AXLayoutComplete, true);
+        postNotification(obj, AXLayoutComplete, true);
 }
 
 void AXObjectCacheImpl::handleAriaExpandedChange(Node* node)
 {
     if (AXObject* obj = getOrCreate(node))
         obj->handleAriaExpandedChanged();
 }
 
 void AXObjectCacheImpl::handleActiveDescendantChanged(Node* node)
 {
@@ skipping 209 matching lines @@
 }
 
 void AXObjectCacheImpl::handleUpdateActiveMenuOption(LayoutMenuList* menuList, int optionIndex)
 {
     if (AXMenuList* axMenuList = static_cast<AXMenuList*>(get(menuList)))
         axMenuList->didUpdateActiveOption(optionIndex);
 }
 
 void AXObjectCacheImpl::handleLoadComplete(Document* document)
 {
-    postNotification(getOrCreate(document), document, AXObjectCache::AXLoadComplete, true);
+    postNotification(getOrCreate(document), AXObjectCache::AXLoadComplete, true);
 }
 
 void AXObjectCacheImpl::handleLayoutComplete(Document* document)
 {
-    postNotification(getOrCreate(document), document, AXObjectCache::AXLayoutComplete, true);
+    postNotification(getOrCreate(document), AXObjectCache::AXLayoutComplete, true);
 }
 
 void AXObjectCacheImpl::handleScrolledToAnchor(const Node* anchorNode)
 {
     // The anchor node may not be accessible. Post the notification for the
     // first accessible object.
     postPlatformNotification(firstAccessibleObjectFromNode(anchorNode), AXScrolledToAnchor);
 }
 
 void AXObjectCacheImpl::handleScrollPositionChanged(FrameView* frameView)
@@ skipping 57 matching lines @@
 void AXObjectCacheImpl::setCanvasObjectBounds(Element* element, const LayoutRect& rect)
 {
     AXObject* obj = getOrCreate(element);
     if (!obj)
         return;
 
     obj->setElementRect(rect);
 }
 
 } // namespace blink