Add null check when reporting changed nodes to an AX tree.

ui/accessibility/ax_tree.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/accessibility/ax_tree.h"
 
 #include <stddef.h>
 
 #include <set>
 
@@ skipping 202 matching lines @@
     }
     return false;
   }
 
   if (delegate_) {
     std::set<AXNode*>& new_nodes = update_state.new_nodes;
     std::vector<AXTreeDelegate::Change> changes;
     changes.reserve(update.nodes.size());
     for (size_t i = 0; i < update.nodes.size(); ++i) {
       AXNode* node = GetFromId(update.nodes[i].id);
+      if (!node)

[David Tseng, 2017/06/07 23:24:24]

At this point, I would have expected there to be pending nodes above? Why wasn't
this caught by the deserialization below?

[dmazzoni, 2017/06/19 17:12:24]

Imagine that B's parent is A, but B is invisible so
A does not list B as a child. We were unserializing
B and then A, in that order. B unserializes fine. Then
we get to A, and A does not list B as a child anymore,
so B gets deleted. Then later during postprocessing we
search for B but it's no longer in the tree.

It's a weird corner case but I don't think the
unserialization logic was wrong other than this
missing null check.

+        continue;
+
       bool is_new_node = new_nodes.find(node) != new_nodes.end();
       bool is_reparented_node =
           is_new_node && update_state.HasRemovedNode(node);
 
       AXTreeDelegate::ChangeType change = AXTreeDelegate::NODE_CHANGED;
       if (is_new_node) {
         if (is_reparented_node) {
           // A reparented subtree is any new node whose parent either doesn't
           // exist, or is not new.
           bool is_subtree = !node->parent() ||
@@ skipping 260 matching lines @@
       update_state->pending_nodes.insert(child);
       update_state->new_nodes.insert(child);
     }
     new_children->push_back(child);
   }
 
   return success;
 }
 
 }  // namespace ui