Fix crash when cached parent of AXLayoutObject is stale.

third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
index d88be1191e520dda01cbcee7452198e8abd6a236..cabb0ece20a1a07d6ca8ade04a4b577ebbefca87 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp
@@ -1639,8 +1639,10 @@ void AXLayoutObject::addChildren()
     computeAriaOwnsChildren(ownedChildren);
 
     for (AXObject* obj = rawFirstChild(); obj; obj = obj->rawNextSibling()) {
-        if (!axObjectCache().isAriaOwned(obj))
+        if (!axObjectCache().isAriaOwned(obj)) {
+            obj->setParent(this);
             addChild(obj);
+        }
     }
 
     addHiddenChildren();