Add fuzzer for AXTree and fix a couple of bugs it found.

ui/accessibility/ax_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accessibility/ax_tree.h"
 
 #include <stddef.h>
 
 #include <set>
 
@@ skipping 202 matching lines @@
     update_state->new_nodes.insert(node);
     node->SetData(src);
   }
 
   if (delegate_)
     delegate_->OnNodeChanged(this, node);
 
   // First, delete nodes that used to be children of this node but aren't
   // anymore.
   if (!DeleteOldChildren(node, src.child_ids, update_state)) {
-    if (update_state->new_root)
-      DestroySubtree(update_state->new_root, update_state);
+    if (update_state->new_root) {
+      DestroySubtree(root_, update_state);
+      root_ = nullptr;
+    }
     return false;
   }
 
   // Now build a new children vector, reusing nodes when possible,
   // and swap it in.
   std::vector<AXNode*> new_children;
   bool success = CreateNewChildVector(
       node, src.child_ids, &new_children, update_state);
   node->SwapChildren(new_children);
 
   // Update the root of the tree if needed.
   if (is_new_root) {
     // Make sure root_ always points to something valid or null_, even inside
     // DestroySubtree.
     AXNode* old_root = root_;
     root_ = node;
-    if (old_root)
+    if (old_root && old_root != node)
       DestroySubtree(old_root, update_state);
   }
 
   return success;
 }
 
 void AXTree::DestroySubtree(AXNode* node,
                             AXTreeUpdateState* update_state) {
   if (delegate_)
     delegate_->OnSubtreeWillBeDeleted(this, node);
@@ skipping 68 matching lines @@
       update_state->pending_nodes.insert(child);
       update_state->new_nodes.insert(child);
     }
     new_children->push_back(child);
   }
 
   return success;
 }
 
 }  // namespace ui