Ignore accessibility events fired on objects that aren't in the tree.

content/renderer/accessibility/renderer_accessibility_complete.cc

Index: content/renderer/accessibility/renderer_accessibility_complete.cc
diff --git a/content/renderer/accessibility/renderer_accessibility_complete.cc b/content/renderer/accessibility/renderer_accessibility_complete.cc
index 4a9de8f017da41809f384d46e687d5b1ba59dbc4..e8236988c086e2076e1ca43eebbadb6434fbf803 100644
--- a/content/renderer/accessibility/renderer_accessibility_complete.cc
+++ b/content/renderer/accessibility/renderer_accessibility_complete.cc
@@ -184,8 +184,14 @@ void RendererAccessibilityComplete::SendPendingAccessibilityEvents() {
 
     WebAXObject obj = document.accessibilityObjectFromID(
         event.id);
+    // Make sure the object still exists.
     if (!obj.updateBackingStoreAndCheckValidity())
       continue;
+    // Make sure it's a descendant of our root node - exceptions include the
+    // scroll area that's the parent of the main document (we ignore it), and
+    // possibly nodes attached to a different document.
+    if (!tree_source_.IsInTree(obj))
+      continue;
 
     // When we get a "selected children changed" event, Blink
     // doesn't also send us events for each child that changed