AX hittest shouldn't crash when <option> element doesn't have corresponding <select>

third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 1482 matching lines @@
     return IntPoint(bounds.x() + (bounds.width() / 2), bounds.y() - (bounds.height() / 2));
 }
 
 //
 // Hit testing.
 //
 
 AXObject* AXLayoutObject::accessibilityHitTest(const IntPoint& point) const
 {
     if (!m_layoutObject || !m_layoutObject->hasLayer())
-        return 0;
+        return nullptr;
 
     PaintLayer* layer = toLayoutBox(m_layoutObject)->layer();
 
     HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
     HitTestResult hitTestResult = HitTestResult(request, point);
     layer->hitTest(hitTestResult);
-    if (!hitTestResult.innerNode())
-        return 0;
 
     Node* node = hitTestResult.innerNode();
+    if (!node)
+        return nullptr;
 
     if (isHTMLAreaElement(node))
         return accessibilityImageMapHitTest(toHTMLAreaElement(node), point);
 
-    if (isHTMLOptionElement(node))
+    if (isHTMLOptionElement(node)) {
         node = toHTMLOptionElement(*node).ownerSelectElement();
+        if (!node)
+            return nullptr;
+    }
 
     LayoutObject* obj = node->layoutObject();
     if (!obj)
-        return 0;
+        return nullptr;
 
     AXObject* result = axObjectCache().getOrCreate(obj);
     result->updateChildrenIfNecessary();
 
     // Allow the element to perform any hit-testing it might need to do to reach non-layout children.
     result = result->elementAccessibilityHitTest(point);
     if (result && result->accessibilityIsIgnored()) {
         // If this element is the label of a control, a hit test should return the control.
         if (result->isAXLayoutObject()) {
             AXObject* controlObject = toAXLayoutObject(result)->correspondingControlForLabelElement();
@@ skipping 1042 matching lines @@
                     result.unite(labelRect);
                 }
             }
         }
     }
 
     return result;
 }
 
 } // namespace blink