Speculative fix for crasher.

I speculate that WebAXObject::IsDetached() may not be as reliable
as Document::IsDetached().

Also, add a SECURITY_CHECK in the place where I suspect the bad
access is happening.

BUG=722801
R=dmazzoni@chromium.org,skobes@chromium.org

Review-Url: https://codereview.chromium.org/2892283002
Cr-Commit-Position: refs/heads/master@{#473448}

third_party/WebKit/Source/core/frame/ResizeViewportAnchor.cpp

@@ -15,7 +15,8 @@ namespace blink {
 
 void ResizeViewportAnchor::ResizeFrameView(IntSize size) {
   FrameView* frame_view = RootFrameView();
-  DCHECK(frame_view);
+  // TODO(szager): Remove this CHECK if it doesn't show up in crash reports.
+  CHECK(frame_view);
 
   ScrollableArea* root_viewport = frame_view->GetScrollableArea();
   ScrollOffset offset = root_viewport->GetScrollOffset();

third_party/WebKit/Source/web/WebAXObject.cpp

@@ -160,7 +160,9 @@ int WebAXObject::GenerateAXID() const {
 bool WebAXObject::UpdateLayoutAndCheckValidity() {
   if (!IsDetached()) {
     Document* document = private_->GetDocument();
-    if (!document || !document->View())
+    // TODO(szager): Investigate whether/why document->IsDetached() can be
+    // true when this->IsDetached() is false.
+    if (!document || !document->View() || document->IsDetached())
       return false;
     document->View()->UpdateLifecycleToCompositingCleanPlusScrolling();
   }