Speculative fix for crash when GetOrCreate() destroys the current obj

I suspect that in the AddNodeChildren() loop, soemthing is causing the
current object to be deleted.

Bug: 1158511, 1158385
Change-Id: Ic393b5163616dc6a4995c43d22ac2e2d627656c2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2596792
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838984}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -3218,16 +3218,20 @@ void AXNodeObject::AddLayoutChildren() {
 void AXNodeObject::AddNodeChildren() {
   if (!node_)
     return;
+
   for (Node* child = LayoutTreeBuilderTraversal::FirstChild(*node_); child;
        child = LayoutTreeBuilderTraversal::NextSibling(*child)) {
     AXObject* child_obj = AXObjectCache().GetOrCreate(child);
-
     if (RuntimeEnabledFeatures::AccessibilityExposeIgnoredNodesEnabled() &&
         child_obj &&
         child_obj->RoleValue() == ax::mojom::blink::Role::kStaticText &&
         child_obj->CanIgnoreTextAsEmpty())
       continue;
 
+    // TODO(crbug.com/1158511) This shouldn't be needed!
+    if (IsDetached())
+      return;
+
     AddChild(child_obj);
   }
 }
@@ -3252,6 +3256,10 @@ void AXNodeObject::AddChildren() {
   else
     AddNodeChildren();
 
+  // TODO(crbug.com/1158511) This shouldn't be needed!
+  if (IsDetached())
+    return;
+
   AddPopupChildren();
   AddImageMapChildren();
   AddInlineTextBoxChildren(false);