Ignore accessibility events fired on objects that aren't in the tree.

content/renderer/accessibility/renderer_accessibility_complete.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/accessibility/renderer_accessibility_complete.h"
 
 #include <queue>
 
 #include "base/bind.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 168 matching lines @@
 
   // Loop over each event and generate an updated event message.
   for (size_t i = 0; i < src_events.size(); ++i) {
     AccessibilityHostMsg_EventParams& event =
         src_events[i];
 
     WebAXObject obj = document.accessibilityObjectFromID(
         event.id);
     if (!obj.updateBackingStoreAndCheckValidity())
       continue;
+    if (!tree_source_.IsInTree(obj))

[Peter Lundblad, 2014/05/07 23:03:24]

Can you add some brief comment why the node wouldn't be in the tree?

[dmazzoni, 2014/05/08 15:12:23]

Done.

+      continue;
 
     // When we get a "selected children changed" event, Blink
     // doesn't also send us events for each child that changed
     // selection state, so make sure we re-send that whole subtree.
     if (event.event_type ==
         ui::AX_EVENT_SELECTED_CHILDREN_CHANGED) {
       serializer_.DeleteClientSubtree(obj);
     }
 
     AccessibilityHostMsg_EventParams event_msg;
@@ skipping 176 matching lines @@
     render_view()->GetWebView()->clearFocusedElement();
   else
     obj.setFocused(true);
 }
 
 void RendererAccessibilityComplete::OnFatalError() {
   CHECK(false) << "Invalid accessibility tree.";
 }
 
 }  // namespace content