Avoid calling AXObjectCacheImpl::isAriaOwned with null parameter

third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

 /*
  * Copyright (C) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 1860 matching lines @@
 
     // The only time we add children from the DOM tree to a node with a layoutObject is when it's a canvas.
     if (getLayoutObject() && !isHTMLCanvasElement(*m_node))
         return;
 
     HeapVector<Member<AXObject>> ownedChildren;
     computeAriaOwnsChildren(ownedChildren);
 
     for (Node& child : NodeTraversal::childrenOf(*m_node)) {
         AXObject* childObj = axObjectCache().getOrCreate(&child);
-        if (!axObjectCache().isAriaOwned(childObj))
+        if (childObj && !axObjectCache().isAriaOwned(childObj))
             addChild(childObj);
     }
 
     for (const auto& ownedChild : ownedChildren)
         addChild(ownedChild);
 
     for (const auto& child : m_children)
         child->setParent(this);
 }
 
@@ skipping 940 matching lines @@
     return placeholder;
 }
 
 DEFINE_TRACE(AXNodeObject)
 {
     visitor->trace(m_node);
     AXObject::trace(visitor);
 }
 
 } // namespace blink