Add fuzzer for AXTree and fix a couple of bugs it found.

ui/accessibility/ax_tree_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accessibility/ax_tree.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
@@ skipping 414 matching lines @@
       fake_delegate.subtree_reparented_finished_ids();
   std::vector<int> node_reparented =
       fake_delegate.node_reparented_finished_ids();
   ASSERT_EQ(std::find(created.begin(), created.end(), 3), created.end());
   ASSERT_NE(std::find(subtree_reparented.begin(), subtree_reparented.end(), 3),
             subtree_reparented.end());
   ASSERT_EQ(std::find(node_reparented.begin(), node_reparented.end(), 3),
             node_reparented.end());
 }
 
+// UAF caught by ax_tree_fuzzer
+TEST(AXTreeTest, BogusAXTree) {
+  AXTreeUpdate initial_state;
+  AXNodeData node;
+  node.id = 0;
+  node.state = 0;
+  initial_state.nodes.push_back(node);
+  initial_state.nodes.push_back(node);
+  ui::AXTree tree;
+  tree.Unserialize(initial_state);
+}
+
+// UAF caught by ax_tree_fuzzer
+TEST(AXTreeTest, BogusAXTree2) {
+  AXTreeUpdate initial_state;
+  AXNodeData node;
+  node.id = 0;
+  node.state = 0;
+  initial_state.nodes.push_back(node);
+  AXNodeData node2;
+  node2.id = 0;
+  node2.state = 0;
+  node2.child_ids.push_back(0);
+  node2.child_ids.push_back(0);
+  initial_state.nodes.push_back(node2);
+  ui::AXTree tree;
+  tree.Unserialize(initial_state);
+}
+
 }  // namespace ui