Avoid crash-inducing layout checks when determining table roles

For some reason this fixes the crash, although the other layout checks
in NativeRoleIgnoringAria() seem to be ok.

Bug: 945286
Change-Id: I2b2f9450a5a2e98f4a8c34169d86ef54aff74a72
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1570820Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#651787}

third_party/blink/renderer/modules/accessibility/ax_layout_object.cc

@@ -230,7 +230,7 @@ ax::mojom::Role AXLayoutObject::NativeRoleIgnoringAria() const {
   // ARIA 1.2 (and Core-AAM 1.1) state that elements which are focusable
   // and not hidden must be included in the accessibility tree.
   if (layout_object_->IsTableSection()) {
-    if (CanSetFocusAttribute())
+    if (node && node->IsElementNode() && ToElement(node)->SupportsFocus())
       return ax::mojom::Role::kGroup;
     return ax::mojom::Role::kIgnored;
   }
@@ -3153,7 +3153,7 @@ ax::mojom::Role AXLayoutObject::DetermineTableRowRole() const {
   if (!parent)
     return ax::mojom::Role::kGenericContainer;
 
-  if (parent->GetLayoutObject()->IsTableSection())
+  if (parent->RoleValue() == ax::mojom::Role::kGroup)
     parent = parent->ParentObjectUnignored();
 
   if (parent->RoleValue() == ax::mojom::Role::kLayoutTable)
@@ -3173,7 +3173,7 @@ ax::mojom::Role AXLayoutObject::DetermineTableCellRole() const {
     return ax::mojom::Role::kGenericContainer;
 
   AXObject* grandparent = parent->ParentObjectUnignored();
-  if (grandparent && grandparent->GetLayoutObject()->IsTableSection())
+  if (grandparent && grandparent->RoleValue() == ax::mojom::Role::kGroup)
     grandparent = grandparent->ParentObjectUnignored();
 
   if (!grandparent || !grandparent->IsTableLikeRole())