Fix a possible renderer hang due to an WebAccessibilityObject becoming invalid.

content/renderer/renderer_accessibility.cc

Index: content/renderer/renderer_accessibility.cc
diff --git a/content/renderer/renderer_accessibility.cc b/content/renderer/renderer_accessibility.cc
index 2ca15dd012f7e7e2d81f324b3c473671c7bbd8f0..c7007025944fa9438a063a0acd4359febd3e4124 100644
--- a/content/renderer/renderer_accessibility.cc
+++ b/content/renderer/renderer_accessibility.cc
@@ -213,14 +213,6 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
     WebAccessibilityObject obj = document.accessibilityObjectFromID(
         notification.id);
 
-    if (!obj.isValid()) {
-#ifndef NDEBUG
-      if (logging_)
-        LOG(WARNING) << "Got notification on invalid object id " << obj.axID();
-#endif
-      continue;
-    }
-
     // The browser may not have this object yet, for example if we get a
     // notification on an object that was recently added, or if we get a
     // notification on a node before the page has loaded. Work our way
@@ -229,6 +221,14 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
     int root_id = document.accessibilityObject().axID();
     while (browser_id_map_.find(obj.axID()) == browser_id_map_.end() &&
            obj.axID() != root_id) {
+      if (!obj.isValid()) {
+#ifndef NDEBUG
+        if (logging_)
+          LOG(WARNING) << "Got notification on invalid object id " << obj.axID();
+#endif
+        break;
+      }
+
       obj = obj.parentObject();
       includes_children = true;
       if (notification.type ==
@@ -237,6 +237,9 @@ void RendererAccessibility::SendPendingAccessibilityNotifications() {
       }
     }
 
+    if (!obj.isValid())
+      continue;
+
     // Another potential problem is that this notification may be on an
     // object that is detached from the tree. Determine if this node is not a
     // child of its parent, and if so move the notification to the parent.