Fix null dereference

Bug: 1124781,1124757
Change-Id: I36aa26810557cbc876ccf68e1fb458d9a18c00fd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2392796Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804372}

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -831,10 +831,10 @@ void AXObjectCacheImpl::DeferTreeUpdateInternal(base::OnceClosure callback,
   if (obj->IsDetached())
     return;
 
-  Document& tree_update_document = *obj->GetDocument();
+  Document* tree_update_document = obj->GetDocument();
 
   // Ensure the tree update document is in a good state.
-  if (!IsActive(tree_update_document))
+  if (!tree_update_document || !IsActive(*tree_update_document))
     return;
 
   if (tree_update_callback_queue_.size() >= max_pending_updates_) {
@@ -845,10 +845,10 @@ void AXObjectCacheImpl::DeferTreeUpdateInternal(base::OnceClosure callback,
     return;
   }
 
-  DCHECK(!tree_update_document.GetPage()->Animator().IsServicingAnimations() ||
-         (tree_update_document.Lifecycle().GetState() <
+  DCHECK(!tree_update_document->GetPage()->Animator().IsServicingAnimations() ||
+         (tree_update_document->Lifecycle().GetState() <
               DocumentLifecycle::kInAccessibility ||
-          tree_update_document.Lifecycle().StateAllowsDetach()))
+          tree_update_document->Lifecycle().StateAllowsDetach()))
       << "DeferTreeUpdateInternal should only be outside of the lifecycle or "
          "before the accessibility state.";
   tree_update_callback_queue_.push_back(MakeGarbageCollected<TreeUpdateParams>(