IAccessible::get_accChild should only return a descendant.

content/browser/accessibility/browser_accessibility_win.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/accessibility/browser_accessibility_win.h"
 
 #include <UIAutomationClient.h>
 #include <UIAutomationCoreApi.h>
 
 #include <algorithm>
@@ skipping 3563 matching lines @@
 }
 
 BrowserAccessibilityWin* BrowserAccessibilityWin::NewReference() {
   AddRef();
   return this;
 }
 
 BrowserAccessibilityWin* BrowserAccessibilityWin::GetTargetFromChildID(
     const VARIANT& var_id) {
   if (var_id.vt != VT_I4)
-    return NULL;
+    return nullptr;
 
   LONG child_id = var_id.lVal;
   if (child_id == CHILDID_SELF)
     return this;
 
   if (child_id >= 1 && child_id <= static_cast<LONG>(PlatformChildCount()))
     return ToBrowserAccessibilityWin(PlatformGetChild(child_id - 1));
 
-  return ToBrowserAccessibilityWin(
+  BrowserAccessibilityWin* child = ToBrowserAccessibilityWin(
       BrowserAccessibility::GetFromUniqueID(-child_id));
+  if (child && child->IsDescendantOf(this))
+    return child;
+
+  return nullptr;
 }
 
 HRESULT BrowserAccessibilityWin::GetStringAttributeAsBstr(
     ui::AXStringAttribute attribute,
     BSTR* value_bstr) {
   base::string16 str;
 
   if (!GetString16Attribute(attribute, &str))
     return S_FALSE;
 
@@ skipping 1080 matching lines @@
   return static_cast<BrowserAccessibilityWin*>(obj);
 }
 
 const BrowserAccessibilityWin*
 ToBrowserAccessibilityWin(const BrowserAccessibility* obj) {
   DCHECK(!obj || obj->IsNative());
   return static_cast<const BrowserAccessibilityWin*>(obj);
 }
 
 }  // namespace content