Fix crash in WebAXObject::showContextMenu

third_party/WebKit/Source/web/WebAXObject.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 954 matching lines @@
     if (isDetached())
         return;
 
     Node* node = m_private->getNode();
     if (!node)
         return;
 
     Element* element = nullptr;
     if (node->isElementNode()) {
         element = toElement(node);
+    } else if (node->isDocumentNode()) {
+        element = node->document().documentElement();
     } else {
         node->updateDistribution();
         ContainerNode* parent = FlatTreeTraversal::parent(*node);
+        if (!parent)
+            return;
         ASSERT_WITH_SECURITY_IMPLICATION(parent->isElementNode());
         element = toElement(parent);
     }
 
     if (!element)
         return;
 
     LocalFrame* frame = element->document().frame();
     if (!frame)
         return;
@@ skipping 614 matching lines @@
     m_private = object;
     return *this;
 }
 
 WebAXObject::operator AXObject*() const
 {
     return m_private.get();
 }
 
 } // namespace blink