Revert of Add fuzzer for AXTree and fix a couple of bugs it found. (patchset...

Revert of Add fuzzer for AXTree and fix a couple of bugs it found. (patchset #3 id:40001 of https://codereview.chromium.org/2323103002/ )

Reason for revert:
Caused Address Sanitizer problem with BrowserAccessibilityManagerTest.TestFatalError

BUG=646777

Original issue's description:
> Add fuzzer for AXTree and fix a couple of bugs it found.
>
> BUG=none
>
> Committed: https://crrev.com/cd760f121c0701c0f7609a3437735751cf4ac416
> Cr-Commit-Position: refs/heads/master@{#418308}

TBR=aarya@google.com,aboxhall@chromium.org,mmoroz@chromium.org,ochang@chromium.org,dmazzoni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review-Url: https://codereview.chromium.org/2346473002
Cr-Commit-Position: refs/heads/master@{#418541}

ui/accessibility/BUILD.gn

@@ -6,7 +6,6 @@ import("//build/config/linux/pkg_config.gni")
 import("//build/config/features.gni")
 import("//build/config/ui.gni")
 import("//build/json_schema_api.gni")
-import("//testing/libfuzzer/fuzzer_test.gni")
 import("//testing/test.gni")
 if (is_android) {
   import("//build/config/android/rules.gni")
@@ -154,13 +153,3 @@ json_schema_api("ax_gen") {
   root_namespace = "ui"
   schemas = true
 }
-
-fuzzer_test("ax_tree_fuzzer") {
-  sources = [
-    "ax_tree_fuzzer.cc",
-  ]
-
-  deps = [
-    ":accessibility",
-  ]
-}

ui/accessibility/ax_tree.cc

@@ -243,16 +243,8 @@ bool AXTree::UpdateNode(const AXNodeData& src,
   // First, delete nodes that used to be children of this node but aren't
   // anymore.
   if (!DeleteOldChildren(node, src.child_ids, update_state)) {
-    if (update_state->new_root) {
-      DestroySubtree(root_, update_state);
-
-      if (node != root_ &&
-          update_state->new_nodes.find(node) != update_state->new_nodes.end()) {
-        DestroySubtree(node, update_state);
-      }
-
-      root_ = nullptr;
-    }
+    if (update_state->new_root)
+      DestroySubtree(update_state->new_root, update_state);
     return false;
   }
 
@@ -269,7 +261,7 @@ bool AXTree::UpdateNode(const AXNodeData& src,
     // DestroySubtree.
     AXNode* old_root = root_;
     root_ = node;
-    if (old_root && old_root != node)
+    if (old_root)
       DestroySubtree(old_root, update_state);
   }
 

ui/accessibility/ax_tree_fuzzer.cc

-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "ui/accessibility/ax_tree.h"
-
-class EmptyAXTreeDelegate : public ui::AXTreeDelegate {
- public:
-  EmptyAXTreeDelegate() {}
-
-  void OnNodeDataWillChange(ui::AXTree* tree,
-                            const ui::AXNodeData& old_node_data,
-                            const ui::AXNodeData& new_node_data) override {}
-  void OnTreeDataChanged(ui::AXTree* tree) override {}
-  void OnNodeWillBeDeleted(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnSubtreeWillBeDeleted(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnNodeWillBeReparented(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnSubtreeWillBeReparented(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnNodeCreated(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnNodeReparented(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnNodeChanged(ui::AXTree* tree, ui::AXNode* node) override {}
-  void OnAtomicUpdateFinished(ui::AXTree* tree,
-                              bool root_changed,
-                              const std::vector<Change>& changes) override {}
-};
-
-// Entry point for LibFuzzer.
-extern "C" int LLVMFuzzerTestOneInput(const unsigned char* data, size_t size) {
-  ui::AXTreeUpdate initial_state;
-  size_t i = 0;
-  while (i < size) {
-    ui::AXNodeData node;
-    node.id = data[i++];
-    node.state = 0;
-    if (i < size) {
-      size_t child_count = data[i++];
-      for (size_t j = 0; j < child_count && i < size; j++)
-        node.child_ids.push_back(data[i++]);
-    }
-    initial_state.nodes.push_back(node);
-  }
-
-  // Run with --v=1 to aid in debugging a specific crash.
-  VLOG(1) << "Input accessibility tree:\n" << initial_state.ToString();
-
-  ui::AXTree tree;
-  EmptyAXTreeDelegate delegate;
-  tree.SetDelegate(&delegate);
-  tree.Unserialize(initial_state);
-
-  return 0;
-}

ui/accessibility/ax_tree_unittest.cc

@@ -479,33 +479,4 @@ TEST(AXTreeTest, TreeDelegateIsNotCalledForReparenting) {
   tree.SetDelegate(NULL);
 }
 
-// UAF caught by ax_tree_fuzzer
-TEST(AXTreeTest, BogusAXTree) {
-  AXTreeUpdate initial_state;
-  AXNodeData node;
-  node.id = 0;
-  node.state = 0;
-  initial_state.nodes.push_back(node);
-  initial_state.nodes.push_back(node);
-  ui::AXTree tree;
-  tree.Unserialize(initial_state);
-}
-
-// UAF caught by ax_tree_fuzzer
-TEST(AXTreeTest, BogusAXTree2) {
-  AXTreeUpdate initial_state;
-  AXNodeData node;
-  node.id = 0;
-  node.state = 0;
-  initial_state.nodes.push_back(node);
-  AXNodeData node2;
-  node2.id = 0;
-  node2.state = 0;
-  node2.child_ids.push_back(0);
-  node2.child_ids.push_back(0);
-  initial_state.nodes.push_back(node2);
-  ui::AXTree tree;
-  tree.Unserialize(initial_state);
-}
-
 }  // namespace ui