Ensure node attachment is safe

Bug: None
Change-Id: I38d4bbba6a1d1ef731a4c3e8cd897ac8e26083ed
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2167414
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#762764}

third_party/blink/renderer/modules/accessibility/ax_object_cache_impl.cc

@@ -940,6 +940,7 @@ void AXObjectCacheImpl::DocumentTitleChanged() {
 }
 
 void AXObjectCacheImpl::UpdateCacheAfterNodeIsAttached(Node* node) {
+  SCOPED_DISALLOW_LIFECYCLE_TRANSITION(node->GetDocument());
   // Calling get() will update the AX object if we had an AXNodeObject but now
   // we need an AXLayoutObject, because it was reparented to a location outside
   // of a canvas.