Add a WebContentsImpl API to snapshot the accessibility tree.

content/browser/frame_host/render_frame_host_impl.cc

Index: content/browser/frame_host/render_frame_host_impl.cc
diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index d4cc6f50c5f352ef7c908d8f5601785b97335ec6..90ad806787a6f3310e4364c0a545a772ec74e1d5 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -64,6 +64,7 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "ui/accessibility/ax_tree.h"
+#include "ui/accessibility/ax_tree_update.h"
 #include "url/gurl.h"
 
 #if defined(OS_MACOSX)
@@ -381,6 +382,8 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnAccessibilityLocationChanges)
     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_FindInPageResult,
                         OnAccessibilityFindInPageResult)
+    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_SnapshotResponse,
+                        OnAccessibilitySnapshotResponse)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ToggleFullscreen, OnToggleFullscreen)
     // The following message is synthetic and doesn't come from RenderFrame, but
     // from RenderProcessHost.
@@ -1078,6 +1081,15 @@ void RenderFrameHostImpl::OnRenderProcessGone(int status, int exit_code) {
         render_view_host_, static_cast<base::TerminationStatus>(status),
         exit_code);
   }
+
+  // Execute any pending AX tree snapshot callbacks with an empty response,
+  // since we're never going to get a response from this renderer.
+  for (auto iter = ax_tree_snapshot_callbacks_.begin();
+       iter != ax_tree_snapshot_callbacks_.end();
+       ++iter) {
+    iter->second.Run(ui::AXTreeUpdate());

[Charlie Reis, 2015/04/10 20:18:07]

Sanity check: we've seen security bugs in the past where we've run callbacks
after the objects they store internally are already deleted.  Are we at risk of
that by running this after sending out the RendererExited/Terminated
notifications?

[dmazzoni, 2015/04/10 21:57:12]

Not unless the caller binds the callback to an Unretained pointer or something
dangerous like that. Here's the next changelist that makes use of this callback
and it looks totally safe, the callback is bound to a scoped java ref.

https://codereview.chromium.org/1073983005

[Charlie Reis, 2015/04/10 22:15:46]

I'll have to take your word for it; ScopedJavaGlobalRef is foreign to me.

I was more concerned about things like AXTreeSnapshotCallback in that CL having
a pointer to something that gets deleted before here, or being stored on an
object that gets deleted before here.  Sounds like it's not an immediate
concern.

+  }
+  ax_tree_snapshot_callbacks_.clear();
 }
 
 void RenderFrameHostImpl::OnSwappedOut() {
@@ -1392,6 +1404,19 @@ void RenderFrameHostImpl::OnAccessibilityFindInPageResult(
   }
 }
 
+void RenderFrameHostImpl::OnAccessibilitySnapshotResponse(
+    int request_id,

[Charlie Reis, 2015/04/10 20:18:07]

Actually, let's call this callback_id (throughout the CL).  request_id is too
easy to confuse with the tracking of network requests in the loader, which isn't
related to this.

[dmazzoni, 2015/04/10 21:57:12]

Done.

+    const ui::AXTreeUpdate& snapshot) {
+  std::map<int, AXTreeSnapshotCallback>::iterator it =
+      ax_tree_snapshot_callbacks_.find(request_id);
+  if (it != ax_tree_snapshot_callbacks_.end()) {
+    it->second.Run(snapshot);
+    ax_tree_snapshot_callbacks_.erase(it);
+  } else {
+    NOTREACHED() << "Received AX tree snapshot response for unknown request";
+  }
+}
+
 void RenderFrameHostImpl::OnToggleFullscreen(bool enter_fullscreen) {
   if (enter_fullscreen)
     delegate_->EnterFullscreenMode(GetLastCommittedURL().GetOrigin());
@@ -1805,6 +1830,14 @@ void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
   Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
 }
 
+void RenderFrameHostImpl::RequestAXTreeSnapshot(
+    AXTreeSnapshotCallback callback) {
+  static int next_id = 1;
+  int id = next_id++;
+  Send(new AccessibilityMsg_SnapshotTree(routing_id_, id));
+  ax_tree_snapshot_callbacks_.insert(std::make_pair(id, callback));
+}
+
 void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
     const base::Callback<void(ui::AXEvent, int)>& callback) {
   accessibility_testing_callback_ = callback;