IAccessible::get_accChild should only return a descendant.

content/browser/accessibility/browser_accessibility_win.cc

Index: content/browser/accessibility/browser_accessibility_win.cc
diff --git a/content/browser/accessibility/browser_accessibility_win.cc b/content/browser/accessibility/browser_accessibility_win.cc
index bf3b0affdd751d7d45d1dc592723149d05660882..9173785251f5b71166820cafbeebeb78a9558258 100644
--- a/content/browser/accessibility/browser_accessibility_win.cc
+++ b/content/browser/accessibility/browser_accessibility_win.cc
@@ -3581,7 +3581,7 @@ BrowserAccessibilityWin* BrowserAccessibilityWin::NewReference() {
 BrowserAccessibilityWin* BrowserAccessibilityWin::GetTargetFromChildID(
     const VARIANT& var_id) {
   if (var_id.vt != VT_I4)
-    return NULL;
+    return nullptr;
 
   LONG child_id = var_id.lVal;
   if (child_id == CHILDID_SELF)
@@ -3590,8 +3590,12 @@ BrowserAccessibilityWin* BrowserAccessibilityWin::GetTargetFromChildID(
   if (child_id >= 1 && child_id <= static_cast<LONG>(PlatformChildCount()))
     return ToBrowserAccessibilityWin(PlatformGetChild(child_id - 1));
 
-  return ToBrowserAccessibilityWin(
+  BrowserAccessibilityWin* child = ToBrowserAccessibilityWin(
       BrowserAccessibility::GetFromUniqueID(-child_id));
+  if (child && child->IsDescendantOf(this))
+    return child;
+
+  return nullptr;
 }
 
 HRESULT BrowserAccessibilityWin::GetStringAttributeAsBstr(