Add a WebContentsImpl API to snapshot the accessibility tree.

content/common/accessibility_messages.h

Index: content/common/accessibility_messages.h
diff --git a/content/common/accessibility_messages.h b/content/common/accessibility_messages.h
index 69dfb51d3aeab0c9cf445a897967ece1e114dcdf..53310f9b3dba242d8a1973a01c157f6f09ac4030 100644
--- a/content/common/accessibility_messages.h
+++ b/content/common/accessibility_messages.h
@@ -178,6 +178,12 @@ IPC_MESSAGE_ROUTED1(AccessibilityMsg_Reset,
 // and we've already reset too many times.
 IPC_MESSAGE_ROUTED0(AccessibilityMsg_FatalError)
 
+// Request a one-time snapshot of the accessibility tree without
+// enabling accessibility if it wasn't already enabled. The passed token
+// will be returned in the AccessibilityHostMsg_SnapshotResponse message.
+IPC_MESSAGE_ROUTED1(AccessibilityMsg_SnapshotTree,
+                    int /* snapshot token */)
+
 // Messages sent from the renderer to the browser.
 
 // Sent to notify the browser about renderer accessibility events.
@@ -200,3 +206,10 @@ IPC_MESSAGE_ROUTED1(
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_FindInPageResult,
     AccessibilityHostMsg_FindInPageResultParams)
+
+// Sent in response to AccessibilityMsg_SnapshotTree. The token that was
+// passed to the request will be returned in |snapshot_token|, along with
+// a standalone snapshot of the accessibility tree.
+IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_SnapshotResponse,
+                    int /* snapshot token */,
+                    ui::AXTreeUpdate)