Handle case where AXObject is destroyed in the middle of a method.

Bug: 852735
Change-Id: I56752deea548f5aa01f9ae3d71f3551841737809
Reviewed-on: https://chromium-review.googlesource.com/1175489Reviewed-by: Alice Boxhall <aboxhall@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#583285}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -2395,6 +2395,10 @@ void AXNodeObject::ChildrenChanged() {
   if (!CanHaveChildren() || cached_is_descendant_of_leaf_node_)
     return;
 
+  // Calling CanHaveChildren(), above, can occasionally detach |this|.
+  if (IsDetached())
+    return;
+
   AXObjectCache().PostNotification(this, AXObjectCacheImpl::kAXChildrenChanged);
 
   // Go up the accessibility parent chain, but only if the element already