From 83ce9f18d70490edb5d154ff04471f9c9fdde346 Mon Sep 17 00:00:00 2001
From: Sky Debreuil <[email protected]>
Date: Fri, 09 Oct 2026 09:35:50 -0700
Subject: [PATCH] [a11y] Mark image dirty directly when removing image map

When removing an HTMLMapElement during immediate tree updates, mark the
associated image AXObject's children dirty directly instead of calling
NotifyParentChildrenChanged mid-traversal.

Change-Id: Ia25df628d938a6bd48d17de46c9e716de847eefd
Bug: 570093145
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8526087
Reviewed-by: Lucas Radaelli <[email protected]>
Auto-Submit: Sky Debreuil <[email protected]>
Reviewed-by: David Tseng <[email protected]>
Commit-Queue: Sky Debreuil <[email protected]>
Commit-Queue: David Tseng <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1715691}
---
diff --git a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
index 718d782..d7d7a68 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc
@@ -2181,7 +2181,14 @@
       // **important**: this call must come before the node traversal remove
       // below since that could remove a child which would cause it to not point
       // to its image parent, making it impossible to notify the parent.
-      NotifyParentChildrenChanged(image_ax_object);
+      if (lifecycle_.GetState() ==
+          AXObjectCacheLifecycle::kProcessDeferredUpdates) {
+        if (AXObject* ancestor = InvalidateChildren(image_ax_object)) {
+          ancestor->ChildrenChangedWithCleanLayout();
+        }
+      } else {
+        NotifyParentChildrenChanged(image_ax_object);
+      }
     }
   }