Merge 118213

Source/WebCore/accessibility/AccessibilityRenderObject.cpp

Index: Source/WebCore/accessibility/AccessibilityRenderObject.cpp
===================================================================
--- Source/WebCore/accessibility/AccessibilityRenderObject.cpp	(revision 119625)
+++ Source/WebCore/accessibility/AccessibilityRenderObject.cpp	(working copy)
@@ -3428,8 +3428,14 @@
         if (parent->supportsARIALiveRegion())
             cache->postNotification(renderParent, AXObjectCache::AXLiveRegionChanged, true);
 
-        if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->isContentEditable())
+        if (parent->isARIATextControl() && !parent->isNativeTextControl() && !parent->node()->isContentEditable()) {
+            // isContentEditable() might trigger a layout update and invalidate the parent.
+            ASSERT(!parent->renderer() || parent->renderer() == renderParent);
+            if (parent->isDetached())
+                break;
+            
             cache->postNotification(renderParent, AXObjectCache::AXValueChanged, true);
+        }
     }
 }