Speculative fix for crasher.

third_party/WebKit/Source/web/WebAXObject.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 142 matching lines @@
 int WebAXObject::GenerateAXID() const {
   if (IsDetached())
     return -1;
 
   return private_->AxObjectCache().GenerateAXID();
 }
 
 bool WebAXObject::UpdateLayoutAndCheckValidity() {
   if (!IsDetached()) {
     Document* document = private_->GetDocument();
-    if (!document || !document->View())
+    if (!document || !document->View() || document->IsDetached())

[dcheng, 2017/05/19 22:55:08]

Can we add a TODO for accessibility to see if we can sync the meaning of
IsDetached() here? It's confusing to have this.

[szager, 2017/05/19 23:04:40]

Done.

       return false;
     document->View()->UpdateLifecycleToCompositingCleanPlusScrolling();
   }
 
   // Doing a layout can cause this object to be invalid, so check again.
   return !IsDetached();
 }
 
 WebAXDefaultActionVerb WebAXObject::Action() const {
   if (IsDetached())
@@ skipping 1380 matching lines @@
 WebAXObject& WebAXObject::operator=(AXObjectImpl* object) {
   private_ = object;
   return *this;
 }
 
 WebAXObject::operator AXObjectImpl*() const {
   return private_.Get();
 }
 
 }  // namespace blink