Null dereference in AXMenuList::DidUpdateActiveOption

This fixes a Null-dereference READ error in AXMenuList.

It can get a issue while adding children
in AXObject::UpdateChildrenIfNecessary.
We check HasChildren() before accessing children to fix it.

Bug: 780931
Change-Id: Ia8442643a7ba06114453084d8208d25393dab865
Reviewed-on: https://chromium-review.googlesource.com/753167
Commit-Queue: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#515910}

third_party/WebKit/Source/modules/accessibility/AXMenuList.cpp

@@ -112,14 +112,17 @@ AccessibilityExpanded AXMenuList::IsExpanded() const {
 void AXMenuList::DidUpdateActiveOption(int option_index) {
   bool suppress_notifications =
       (GetNode() && !GetNode()->IsFinishedParsingChildren());
-  const auto& child_objects = Children();
-  if (!child_objects.IsEmpty()) {
-    DCHECK(child_objects.size() == 1);
-    DCHECK(child_objects[0]->IsMenuListPopup());
-
-    if (child_objects[0]->IsMenuListPopup()) {
-      if (AXMenuListPopup* popup = ToAXMenuListPopup(child_objects[0].Get()))
-        popup->DidUpdateActiveOption(option_index, !suppress_notifications);
+
+  if (HasChildren()) {
+    const auto& child_objects = Children();
+    if (!child_objects.IsEmpty()) {
+      DCHECK_EQ(child_objects.size(), 1ul);
+      DCHECK(child_objects[0]->IsMenuListPopup());
+
+      if (child_objects[0]->IsMenuListPopup()) {
+        if (AXMenuListPopup* popup = ToAXMenuListPopup(child_objects[0].Get()))
+          popup->DidUpdateActiveOption(option_index, !suppress_notifications);
+      }
     }
   }