Bug 1440950 - Remove unslotted subtree even when its root has no accessible. r=nlapre

Differential Revision: https://phabricator.services.mozilla.com/D228101

accessible/generic/DocAccessible.cpp

@@ -863,6 +863,13 @@ void DocAccessible::AttributeChanged(dom::Element* aElement,
     return;
   }
 
+  if (aAttribute == nsGkAtoms::slot &&
+      !aElement->GetFlattenedTreeParentNode() && aElement != mContent) {
+    // Element is inside a shadow host but is no longer slotted.
+    mDoc->ContentRemoved(aElement);
+    return;
+  }
+
   LocalAccessible* accessible = GetAccessible(aElement);
   if (!accessible) {
     if (mContent == aElement) {

accessible/generic/LocalAccessible.cpp

@@ -1566,12 +1566,6 @@ void LocalAccessible::DOMAttributeChanged(int32_t aNameSpaceID,
     // also changed. Push a cache update for Relations.
     mDoc->QueueCacheUpdate(this, CacheDomain::Relations);
   }
-
-  if (aAttribute == nsGkAtoms::slot &&
-      !mContent->GetFlattenedTreeParentNode() && this != mDoc) {
-    // This is inside a shadow host but is no longer slotted.
-    mDoc->ContentRemoved(this);
-  }
 }
 
 void LocalAccessible::ARIAGroupPosition(int32_t* aLevel, int32_t* aSetSize,

accessible/tests/browser/tree/browser_shadowdom.js

@@ -4,6 +4,9 @@
 
 "use strict";
 
+/* import-globals-from ../../mochitest/role.js */
+loadScripts({ name: "role.js", dir: MOCHITESTS_DIR });
+
 const REORDER = { expected: [[EVENT_REORDER, "container"]] };
 
 // Dynamically inserted slotted accessible elements should be in
@@ -96,3 +99,34 @@ addAccessibleTask(
   },
   { chrome: true, topLevel: true, iframe: true, remoteIframe: true }
 );
+
+addAccessibleTask(
+  `
+    <marquee id="container"><span><button>Help</button></span></marquee>
+  `,
+  async function (browser, docAcc) {
+    info("A slotted inline");
+    const container = findAccessibleChildByID(docAcc, "container");
+
+    testAccessibleTree(container, {
+      TEXT_CONTAINER: [{ TEXT_CONTAINER: [{ PUSHBUTTON: { name: "Help" } }] }],
+    });
+
+    const SLOT_REORDER = {
+      expected: [
+        [
+          EVENT_REORDER,
+          evt => getAccessibleDOMNodeID(evt.accessible.parent) == "container",
+        ],
+      ],
+    };
+    await contentSpawnMutation(browser, SLOT_REORDER, function () {
+      content.document.getElementById("container").firstElementChild.slot =
+        "foo";
+    });
+
+    testAccessibleTree(container, {
+      TEXT_CONTAINER: [{ TEXT_CONTAINER: [] }],
+    });
+  }
+);