Fix crash when cached parent of AXLayoutObject is stale.

third_party/WebKit/LayoutTests/accessibility/insert-adjacent-html-causes-crash.xhtml

Index: third_party/WebKit/LayoutTests/accessibility/insert-adjacent-html-causes-crash.xhtml
diff --git a/third_party/WebKit/LayoutTests/accessibility/insert-adjacent-html-causes-crash.xhtml b/third_party/WebKit/LayoutTests/accessibility/insert-adjacent-html-causes-crash.xhtml
new file mode 100644
index 0000000000000000000000000000000000000000..793ea7d1b2dc886076eedd630a785a85a0574529
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/accessibility/insert-adjacent-html-causes-crash.xhtml
@@ -0,0 +1,26 @@
+<!-- This document must be xhtml for the crash to occur -->
+<li xmlns="http://www.w3.org/1999/xhtml">
+  <h1 id="x">x<h1></h1></h1>
+  <script><![CDATA[
+    if (testRunner)
+      testRunner.dumpAsText();
+
+    // Calling accessibleElementById on a nonexistant id has the side effect
+    // of creating an accessibility object for every node in the tree.
+    if (accessibilityController)
+      accessibilityController.accessibleElementById('dummy');
+
+    // Calling insertAdjacentHTML causes the cached parent of an
+    // AXLayoutObject to be invalid after the next layout.
+    x=document.getElementById("x");
+    x.insertAdjacentHTML("beforebegin", "text");
+
+    // Force layout.
+    x.offsetTop;
+
+    // Explore the accessibility tree again, triggering the crash if
+    // the cached parent isn't updated correctly.
+    if (accessibilityController)
+      accessibilityController.accessibleElementById('dummy');
+  ]]></script>
+</li>