UpdateWidget() can fire beforeload event synchronously blowing away RenderArena and its associated …

Source/core/dom/Document.cpp

Index: Source/core/dom/Document.cpp
diff --git a/Source/core/dom/Document.cpp b/Source/core/dom/Document.cpp
index e3ff783900ca656fd499106a88c7daf2f48be5c4..3b610308b2d7509e0dc9d4aa8ab29f0a0272f01a 100644
--- a/Source/core/dom/Document.cpp
+++ b/Source/core/dom/Document.cpp
@@ -2363,14 +2363,16 @@ void Document::implicitClose()
         // The AX cache may have been cleared at this point, but we need to make sure it contains an
         // AX object to send the notification to. getOrCreate will make sure that an valid AX object
         // exists in the cache (we ignore the return value because we don't need it here). This is 
-        // only safe to call when a layout is not in progress, so it can not be used in postNotification.    
-        axObjectCache()->getOrCreate(renderObject);
-        if (this == topDocument())
-            axObjectCache()->postNotification(renderObject, AXObjectCache::AXLoadComplete, true);
-        else {
-            // AXLoadComplete can only be posted on the top document, so if it's a document
-            // in an iframe that just finished loading, post AXLayoutComplete instead.
-            axObjectCache()->postNotification(renderObject, AXObjectCache::AXLayoutComplete, true);
+        // only safe to call when a layout is not in progress, so it can not be used in postNotification.
+        if (AXObjectCache* cache = axObjectCache()) {
+            cache->getOrCreate(renderObject);
+            if (this == topDocument())
+                cache->postNotification(renderObject, AXObjectCache::AXLoadComplete, true);
+            else {
+                // AXLoadComplete can only be posted on the top document, so if it's a document
+                // in an iframe that just finished loading, post AXLayoutComplete instead.
+                cache->postNotification(renderObject, AXObjectCache::AXLayoutComplete, true);
+            }
         }
     }