Add fuzzer for AXTree and fix a couple of bugs it found.

ui/accessibility/BUILD.gn

 # Copyright 2014 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import("//build/config/linux/pkg_config.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//build/json_schema_api.gni")
+import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 if (is_android) {
   import("//build/config/android/rules.gni")
 }
 
 component("accessibility") {
   sources = [
     "ax_node.cc",
     "ax_node.h",
     "ax_node_data.cc",
@@ skipping 127 matching lines @@
 json_schema_api("ax_gen") {
   sources = [
     "ax_enums.idl",
   ]
   deps = [
     "//base/third_party/dynamic_annotations",
   ]
   root_namespace = "ui"
   schemas = true
 }
+
+fuzzer_test("ax_tree_fuzzer") {
+  sources = [
+    "ax_tree_fuzzer.cc",
+  ]
+
+  deps = [
+    ":accessibility",
+  ]
+}