Fix another bug in AXTree caught by libfuzzer

ui/accessibility/ax_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accessibility/ax_tree.h"
 
 #include <stddef.h>
 
 #include <set>
 
@@ skipping 230 matching lines @@
     delegate_->OnNodeChanged(this, node);
 
   // First, delete nodes that used to be children of this node but aren't
   // anymore.
   if (!DeleteOldChildren(node, src.child_ids, update_state)) {
     if (update_state->new_root) {
       AXNode* old_root = root_;
       root_ = nullptr;
 
       DestroySubtree(old_root, update_state);
-      if (node != old_root &&

[aboxhall, 2016/09/26 20:24:44]

Why is this no longer necessary?

[dmazzoni, 2016/09/27 20:19:26]

See next comment

+      if (update_state->removed_node_ids.find(src.id) ==

[aboxhall, 2016/09/26 20:24:44]

Can you describe what this is doing in more detail in the issue description?

[dmazzoni, 2016/09/27 20:19:26]

Updated change description and added comments to code too.

+              update_state->removed_node_ids.end() &&
           update_state->new_nodes.find(node) != update_state->new_nodes.end()) {
         DestroySubtree(node, update_state);
       }
     }
     return false;
   }
 
   // Now build a new children vector, reusing nodes when possible,
   // and swap it in.
   std::vector<AXNode*> new_children;
@@ skipping 98 matching lines @@
       update_state->pending_nodes.insert(child);
       update_state->new_nodes.insert(child);
     }
     new_children->push_back(child);
   }
 
   return success;
 }
 
 }  // namespace ui