Fix another bug in AXTree caught by libfuzzer

ui/accessibility/ax_tree.cc

Index: ui/accessibility/ax_tree.cc
diff --git a/ui/accessibility/ax_tree.cc b/ui/accessibility/ax_tree.cc
index ddf04d01ad9f31884a474fbffec1e70120044301..1d6cc234d9a46645f24b0d137b4c2843201370eb 100644
--- a/ui/accessibility/ax_tree.cc
+++ b/ui/accessibility/ax_tree.cc
@@ -248,7 +248,8 @@ bool AXTree::UpdateNode(const AXNodeData& src,
       root_ = nullptr;
 
       DestroySubtree(old_root, update_state);
-      if (node != old_root &&

[aboxhall, 2016/09/26 20:24:44]

Why is this no longer necessary?

[dmazzoni, 2016/09/27 20:19:26]

See next comment

+      if (update_state->removed_node_ids.find(src.id) ==

[aboxhall, 2016/09/26 20:24:44]

Can you describe what this is doing in more detail in the issue description?

[dmazzoni, 2016/09/27 20:19:26]

Updated change description and added comments to code too.

+              update_state->removed_node_ids.end() &&
           update_state->new_nodes.find(node) != update_state->new_nodes.end()) {
         DestroySubtree(node, update_state);
       }