Avoid crash when dereferencing nullptr when getting child tree root

Bug: 885244,893396
Change-Id: I4ab6c6890af83483514edd41f1e7d2aeb38e4a4a
Reviewed-on: https://chromium-review.googlesource.com/c/1286814Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: David Tseng <dtseng@chromium.org>
Cr-Commit-Position: refs/heads/master@{#600428}

chrome/renderer/extensions/automation_internal_custom_bindings.cc

@@ -1471,7 +1471,7 @@ bool AutomationInternalCustomBindings::GetRootOfChildTree(
   AutomationAXTreeWrapper* child_tree_wrapper =
       GetAutomationAXTreeWrapperFromTreeID(
           ui::AXTreeID::FromString(child_tree_id_str));
-  if (!child_tree_wrapper)
+  if (!child_tree_wrapper || !child_tree_wrapper->tree()->root())
     return false;
 
   *in_out_tree_wrapper = child_tree_wrapper;