Discovered this while figuring out bug 1572317.

STR:

1. Open this test case:
   data:text/html,<div id="combobox" role="combobox" aria-owns="listbox"></div><div id="listbox" role="listbox"></div><button onClick="combobox.hidden = true;">Break things</button>
2. Observe that in the accessibility tree, there is an editcombobox containing a combobox list.
3. Press the "Break things" button.
4. In the accessibility tree, examine the children of the document.
   • Expected: There should be a combobox list (or a listbox?) as well as the "Break things" button.
   • Actual: There's only the button, no combobox list/listbox.

When we remove an Accessible, we seem to remove all of its descendants, even the owned ones. There is code in ContentRemoved and UncacheChildrenInSubtree to clean up mARIAOwnsHash, but it doesn't put the children back. We do have code to put children back, DocAccessible::PutChildrenBack, which we use when aria-owns changes. We should do something similar for removals too.