An accessibility tree update with two roots should be rejected.

ui/accessibility/ax_tree.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef UI_ACCESSIBILITY_AX_TREE_H_
 #define UI_ACCESSIBILITY_AX_TREE_H_
 
 #include <set>
 
 #include "base/containers/hash_tables.h"
@@ skipping 102 matching lines @@
  private:
   AXNode* CreateNode(AXNode* parent, int32 id, int32 index_in_parent);
 
   // This is called from within Unserialize(), it returns true on success.
   bool UpdateNode(const AXNodeData& src, AXTreeUpdateState* update_state);
 
   void OnRootChanged();
 
   // Notify the delegate that the subtree rooted at |node| will be destroyed,
   // then call DestroyNodeAndSubtree on it.
-  void DestroySubtree(AXNode* node);
+  void DestroySubtree(AXNode* node, AXTreeUpdateState* update_state);
 
   // Call Destroy() on |node|, and delete it from the id map, and then
   // call recursively on all nodes in its subtree.
-  void DestroyNodeAndSubtree(AXNode* node);
+  void DestroyNodeAndSubtree(AXNode* node, AXTreeUpdateState* update_state);
 
   // Iterate over the children of |node| and for each child, destroy the
   // child and its subtree if its id is not in |new_child_ids|. Returns
   // true on success, false on fatal error.
   bool DeleteOldChildren(AXNode* node,
-                         const std::vector<int32>& new_child_ids);
+                         const std::vector<int32>& new_child_ids,
+                         AXTreeUpdateState* update_state);
 
   // Iterate over |new_child_ids| and populate |new_children| with
   // pointers to child nodes, reusing existing nodes already in the tree
   // if they exist, and creating otherwise. Reparenting is disallowed, so
   // if the id already exists as the child of another node, that's an
   // error. Returns true on success, false on fatal error.
   bool CreateNewChildVector(AXNode* node,
                             const std::vector<int32>& new_child_ids,
                             std::vector<AXNode*>* new_children,
                             AXTreeUpdateState* update_state);
 
   AXTreeDelegate* delegate_;
   AXNode* root_;
   base::hash_map<int32, AXNode*> id_map_;
   std::string error_;
 };
 
 }  // namespace ui
 
 #endif  // UI_ACCESSIBILITY_AX_TREE_H_