Fix crash when system retains an accessibility object.

content/browser/accessibility/browser_accessibility_cocoa.mm

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <execinfo.h>
 
 #import "content/browser/accessibility/browser_accessibility_cocoa.h"
 
 #include <map>
 
@@ skipping 1403 matching lines @@
 // Returns the deepest accessibility child that should not be ignored.
 // It is assumed that the hit test has been narrowed down to this object
 // or one of its children, so this will never return nil unless this
 // object is invalid.
 - (id)accessibilityHitTest:(NSPoint)point {
   if (!browserAccessibility_)
     return nil;
 
   BrowserAccessibilityCocoa* hit = self;
   for (BrowserAccessibilityCocoa* child in [self children]) {
+    if (!child->browserAccessibility_)
+      continue;
     NSPoint origin = [child origin];
     NSSize size = [[child size] sizeValue];
     NSRect rect;
     rect.origin = origin;
     rect.size = size;
     if (NSPointInRect(point, rect)) {
       hit = child;
       id childResult = [child accessibilityHitTest:point];
       if (![childResult accessibilityIsIgnored]) {
         hit = childResult;
@@ skipping 16 matching lines @@
     return [super hash];
   return browserAccessibility_->renderer_id();
 }
 
 - (BOOL)accessibilityShouldUseUniqueId {
   return YES;
 }
 
 @end