The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/d535bf95b998d1061629905139485c937272fc3b

commit d535bf95b998d1061629905139485c937272fc3b
Author: Dominic Mazzoni <dmazzoni@chromium.org>
Date: Thu Jul 12 06:41:00 2018

Track changes to nodes that are in the AX tree but aren't laid out.

Previously we only had hooks to update the children of a node in the
AX tree when LayoutObjects were inserted or removed. That left out some
corner cases when Nodes are inserted or removed that are part of the
AX tree but not laid out, like nodes in the accessible / fallback content
for a canvas.

Bug:  862311 
Change-Id: I9482a9e0dc9ba45368b2fc87ea3449bdd4ef1c50
Reviewed-on: https://chromium-review.googlesource.com/1132119
Reviewed-by: Alice Boxhall <aboxhall@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#574497}
[add] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/WebKit/LayoutTests/accessibility/children-changed-in-canvas.html
[modify] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/blink/renderer/core/dom/element.cc
[modify] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/blink/renderer/modules/accessibility/ax_layout_object.cc
[modify] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/blink/renderer/modules/accessibility/ax_layout_object.h
[modify] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/blink/renderer/modules/accessibility/ax_node_object.cc
[modify] https://crrev.com/d535bf95b998d1061629905139485c937272fc3b/third_party/blink/renderer/modules/accessibility/ax_node_object.h