RenderAccessibilityImpl::SnapshotAccessibilityTree should ensure layout clean.

content/renderer/accessibility/render_accessibility_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/accessibility/render_accessibility_impl.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <queue>
@@ skipping 40 matching lines @@
 void RenderAccessibilityImpl::SnapshotAccessibilityTree(
     RenderFrameImpl* render_frame,
     AXContentTreeUpdate* response) {
   DCHECK(render_frame);
   DCHECK(response);
   if (!render_frame->GetWebFrame())
     return;
 
   WebDocument document = render_frame->GetWebFrame()->document();
   WebScopedAXContext context(document);
+  WebAXObject root = context.root();
+  if (!root.updateLayoutAndCheckValidity())
+    return;
   BlinkAXTreeSource tree_source(render_frame);
-  tree_source.SetRoot(context.root());
+  tree_source.SetRoot(root);
   BlinkAXTreeSerializer serializer(&tree_source);
   serializer.set_max_node_count(kMaxSnapshotNodeCount);
   serializer.SerializeChanges(context.root(), response);
 }
 
 RenderAccessibilityImpl::RenderAccessibilityImpl(RenderFrameImpl* render_frame)
     : RenderFrameObserver(render_frame),
       render_frame_(render_frame),
       tree_source_(render_frame),
       serializer_(&tree_source_),
@@ skipping 616 matching lines @@
       size_t new_count = pdf_update.nodes.size();
       update->nodes.resize(old_count + new_count);
       for (size_t i = 0; i < new_count; ++i)
         update->nodes[old_count + i] = pdf_update.nodes[i];
       break;
     }
   }
 }
 
 }  // namespace content