AXIsolatedTree::updateChildren removes subtrees that should instead be moved

AXIsolatedTree::updateChildren removes subtrees that should instead be moved
https://bugs.webkit.org/show_bug.cgi?id=236057

Reviewed by Andres Gonzalez.

In AXIsolatedTree::updateChildren, we can sometimes remove subtrees from the nodemap that are
queued to be added somewhere else in the tree. Specifically, this can happen when:

  1. Object 123 is considered to be a new child based on the live AX tree, and we collect node changes for it.
  2. Object 123 is currently a member of a subtree of some other object in oldChildrenIDs.
  3. Because of 2, Object 123 is removed from the node map in removeSubtreeFromNodeMap
  4. We try to queue the addition of this node somewhere in tree in queueChange, but ASSERT because Object 123 is not in the nodemap anymore.

This causes us to hit ASSERT(m_nodeMap.contains(objectID) in AXIsolatedTree::queueChange(const NodeChange&).

This patch fixes this problem by keeping track of the IDs we are queuing for addition
to the tree and making sure we don't remove those IDs.

* accessibility/isolatedtree/AXIsolatedTree.cpp:
(WebCore::AXIsolatedTree::queueChange):
(WebCore::AXIsolatedTree::collectNodeChangesForSubtree):
(WebCore::AXIsolatedTree::nodeAncestryChanges):
Keep track of IDs we are queueing changes for.
(WebCore::AXIsolatedTree::updateChildren):
Keep track of IDs we are queueing changes for and don't remove them,
even if they are part of oldChildrenIDs.
(WebCore::AXIsolatedTree::removeSubtreeFromNodeMap):
* accessibility/isolatedtree/AXIsolatedTree.h:
(WebCore::AXIsolatedTree::removeSubtreeFromNodeMap):
Accept another paramter listing IDs to keep.
(WebCore::AXIsolatedTree::collectNodeChangesForSubtree):
Keep track of IDs we are queueing changes for.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@289097 268f45cc-cd09-0410-ab3c-d52691b4dbfc