chromeos: Fix crash in select-to-speak for keyboard shortcut dialog

The keyboard shortcut dialog is a UI mojo app that runs in a separate
process and has its own AXTree. The code in AutomationManagerAura that
looks up the AXTree ID for a hit test was looking at the wrong
views::View to get the value, due to a confusing condition in how
views::Widget looks up contents views.

Added DCHECKs to make sure this looks up a proper remote AXTree id.

Bug: 872421
Test: Turn on select-to-speak, hit Ctrl-Alt-/, click in dialog
Change-Id: Id9aba72b1aa73b7677e0dc52d1a427c202db0a78
Reviewed-on: https://chromium-review.googlesource.com/1171261Reviewed-by: Katie Dektar <katie@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: James Cook <jamescook@chromium.org>
Cr-Commit-Position: refs/heads/master@{#582998}

chrome/browser/ui/aura/accessibility/automation_manager_aura.cc

@@ -34,6 +34,7 @@
 #include "chrome/browser/chromeos/accessibility/ax_host_service.h"
 #include "components/session_manager/core/session_manager.h"
 #include "ui/base/ui_base_features.h"
+#include "ui/views/widget/widget_delegate.h"
 #endif
 
 using content::BrowserContext;
@@ -265,9 +266,12 @@ void AutomationManagerAura::PerformHitTest(
         views::Widget::GetWidgetForNativeWindow(window->parent());
     CHECK(widget);
     ui::AXNodeData node_data;
-    widget->GetContentsView()->GetAccessibleNodeData(&node_data);
+    widget->widget_delegate()->GetContentsView()->GetAccessibleNodeData(
+        &node_data);
     child_ax_tree_id =
         node_data.GetIntAttribute(ax::mojom::IntAttribute::kChildTreeId);
+    DCHECK_NE(child_ax_tree_id, ui::AXTreeIDRegistry::kNoAXTreeID);
+    DCHECK_NE(child_ax_tree_id, extensions::api::automation::kDesktopTreeID);
   } else {
     // For normal windows the (optional) child tree is an aura window property.
     child_ax_tree_id = window->GetProperty(ui::kChildAXTreeID);