Tiny follow-up to issue with accessibility events on hidden nodes

In http://crrev.com/c/2140033, we ensured that we don't try to serialize
the accessibility tree starting from a node that's not in the tree - that
leads to wasted effort. However, the fix neglected one corner case -
I just debugged a case where the parent of that node not in the tree is
actually a detached node, leading to the exact same serialization problem.

The fix is just to check the parent node validity before serializing,
matching how the original node was checked before serializing.

Bug: 1066880
Change-Id: Idc404fdce697fe368acd033c87552676a2aab950
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2146333Reviewed-by: Mario Sanchez Prada <mario@igalia.com>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758536}

content/renderer/accessibility/render_accessibility_impl.cc

@@ -807,8 +807,11 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
     // nearest ancestor that is (ParentObject() will do this for us).
     // Otherwise this can lead to the serializer doing extra work because
     // the object won't be in |already_serialized_ids|.
-    if (!obj.AccessibilityIsIncludedInTree())
+    if (!obj.AccessibilityIsIncludedInTree()) {
       obj = obj.ParentObject();
+      if (obj.IsDetached())
+        continue;
+    }
 
     if (already_serialized_ids.find(obj.AxID()) != already_serialized_ids.end())
       continue;