Speculative fix for image annotator crash

The call to MaybeUpdateLayoutAndCheckValidity() could end up in a call
to OnImageRemoved(), which would remove the image from the map.

Bug: 1144269
Change-Id: I9d38f2db283b41ce25bc40e95f10156849ebd39e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2537571
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#827290}

content/renderer/accessibility/ax_image_annotator.cc

@@ -271,14 +271,14 @@ SkBitmap AXImageAnnotator::GetImageData(const blink::WebAXObject& image) {
 void AXImageAnnotator::OnImageAnnotated(
     const blink::WebAXObject& image,
     image_annotation::mojom::AnnotateImageResultPtr result) {
-  if (!base::Contains(image_annotations_, image.AxID()))
-    return;
-
   if (!blink::WebAXObject::MaybeUpdateLayoutAndCheckValidity(
           image.GetDocument())) {
     return;
   }
 
+  if (!base::Contains(image_annotations_, image.AxID()))
+    return;
+
   if (image.IsDetached()) {
     image_annotations_.at(image.AxID())
         .set_status(ax::mojom::ImageAnnotationStatus::kIneligibleForAnnotation);