Speculative fix for crash

Bug: 1136880
Change-Id: I32ccf9c9e02a845bd83739f93dc66ef57ea0ff4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2463325
Auto-Submit: Aaron Leventhal <aleventhal@chromium.org>
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#815761}

content/renderer/accessibility/render_accessibility_impl.cc

@@ -848,7 +848,7 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
     // "ParentObject()" always gets the first ancestor that is included in tree
     // (ignored or unignored), so it will never return objects that are not
     // included in the tree at all.
-    if (!obj.AccessibilityIsIncludedInTree())
+    if (!obj.IsDetached() && !obj.AccessibilityIsIncludedInTree())
       obj = obj.ParentObject();
     for (; !obj.IsDetached() && obj.AccessibilityIsIgnored();
          obj = obj.ParentObject()) {