IAccessible::get_accChild should only return a descendant.

ui/accessibility/platform/ax_platform_node_win.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <atlbase.h>
 #include <atlcom.h>
 #include <limits.h>
 #include <oleacc.h>
 #include <stdint.h>
 
@@ skipping 315 matching lines @@
     *disp_child = this;
     (*disp_child)->AddRef();
     return S_OK;
   }
 
   if (child_id >= 1 && child_id <= delegate_->GetChildCount()) {
     // Positive child ids are a 1-based child index, used by clients
     // that want to enumerate all immediate children.
     *disp_child = delegate_->ChildAtIndex(child_id - 1);
     if (!(*disp_child))
-      return E_FAIL;
+      return E_INVALIDARG;
     (*disp_child)->AddRef();
     return S_OK;
   }
 
   if (child_id >= 0)
-    return E_FAIL;
+    return E_INVALIDARG;
 
   // Negative child ids can be used to map to any descendant.
   AXPlatformNodeWin* child = static_cast<AXPlatformNodeWin*>(
       GetFromUniqueId(-child_id));
+  if (child && !IsDescendant(child))
+    child = nullptr;
+
   if (child) {
     *disp_child = child;
     (*disp_child)->AddRef();
     return S_OK;
   }
 
   *disp_child = nullptr;
-  return E_FAIL;
+  return E_INVALIDARG;
 }
 
 STDMETHODIMP AXPlatformNodeWin::get_accChildCount(LONG* child_count) {
   COM_OBJECT_VALIDATE_1_ARG(child_count);
   *child_count = delegate_->GetChildCount();
   return S_OK;
 }
 
 STDMETHODIMP AXPlatformNodeWin::get_accDefaultAction(
     VARIANT var_id, BSTR* def_action) {
@@ skipping 762 matching lines @@
     LONG start_offset,
     ui::TextBoundaryDirection direction) {
   HandleSpecialTextOffset(text, &start_offset);
   ui::TextBoundaryType boundary = IA2TextBoundaryToTextBoundary(ia2_boundary);
   std::vector<int32_t> line_breaks;
   return static_cast<LONG>(ui::FindAccessibleTextBoundary(
       text, line_breaks, boundary, start_offset, direction));
 }
 
 }  // namespace ui