Add fuzzer for AXTree and fix a couple of bugs it found.

ui/accessibility/ax_tree.cc

Index: ui/accessibility/ax_tree.cc
diff --git a/ui/accessibility/ax_tree.cc b/ui/accessibility/ax_tree.cc
index f4be46059453fa219f5dc61d4491d26c04433214..3fda85d345950c6f983da663d671b9b225488585 100644
--- a/ui/accessibility/ax_tree.cc
+++ b/ui/accessibility/ax_tree.cc
@@ -220,8 +220,10 @@ bool AXTree::UpdateNode(const AXNodeData& src,
   // First, delete nodes that used to be children of this node but aren't
   // anymore.
   if (!DeleteOldChildren(node, src.child_ids, update_state)) {
-    if (update_state->new_root)
-      DestroySubtree(update_state->new_root, update_state);
+    if (update_state->new_root) {
+      DestroySubtree(root_, update_state);
+      root_ = nullptr;
+    }
     return false;
   }
 
@@ -238,7 +240,7 @@ bool AXTree::UpdateNode(const AXNodeData& src,
     // DestroySubtree.
     AXNode* old_root = root_;
     root_ = node;
-    if (old_root)
+    if (old_root && old_root != node)
       DestroySubtree(old_root, update_state);
   }