RenderAccessibilityImpl::SnapshotAccessibilityTree should ensure layout clean.

content/renderer/accessibility/render_accessibility_impl.cc

Index: content/renderer/accessibility/render_accessibility_impl.cc
diff --git a/content/renderer/accessibility/render_accessibility_impl.cc b/content/renderer/accessibility/render_accessibility_impl.cc
index 64e9f6e6b72aa03d7fcf0d9c48d0f4aad818472b..8b253ccb537b777302128382ceaf5e8161a6ebf7 100644
--- a/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/content/renderer/accessibility/render_accessibility_impl.cc
@@ -58,8 +58,11 @@ void RenderAccessibilityImpl::SnapshotAccessibilityTree(
 
   WebDocument document = render_frame->GetWebFrame()->document();
   WebScopedAXContext context(document);
+  WebAXObject root = context.root();
+  if (!root.updateLayoutAndCheckValidity())
+    return;
   BlinkAXTreeSource tree_source(render_frame);
-  tree_source.SetRoot(context.root());
+  tree_source.SetRoot(root);
   BlinkAXTreeSerializer serializer(&tree_source);
   serializer.set_max_node_count(kMaxSnapshotNodeCount);
   serializer.SerializeChanges(context.root(), response);