Fix accessible touch exploration inside of iframes.

content/common/accessibility_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // IPC messages for accessibility.
 // Multiply-included message file, hence no include guard.
 
 #include "content/common/ax_content_node_data.h"
 #include "content/common/content_export.h"
 #include "content/common/view_message_enums.h"
@@ skipping 141 matching lines @@
                     int /* New anchor offset */,
                     int /* New focus object id */,
                     int /* New focus offset */)
 
 // Relay a request from assistive technology to set the value of an
 // editable text element.
 IPC_MESSAGE_ROUTED2(AccessibilityMsg_SetValue,
                     int /* object id */,
                     base::string16 /* Value */)
 
-// Determine the accessibility object under a given point and reply with
-// a AccessibilityHostMsg_HitTestResult with the same id.
+// Determine the accessibility object under a given point.
+//
+// If the target is an object with a child frame (like if the hit test
+// result is an iframe element), it responds with
+// AccessibilityHostMsg_ChildFrameHitTestResult so that the
+// hit test can be performed recursively on the child frame. Otherwise
+// it fires an accessibility event of type ui::AX_EVENT_HOVER on the target.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_HitTest,
                     gfx::Point /* location to test */)
 
 // Relay a request from assistive technology to set accessibility focus
 // to a given node. On platforms where this is used (currently Android),
 // inline text boxes are only computed for the node with accessibility focus,
 // rather than for the whole tree.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_SetAccessibilityFocus,
                     int /* object id */)
 
@@ skipping 32 matching lines @@
 IPC_MESSAGE_ROUTED2(
     AccessibilityHostMsg_Events,
     std::vector<AccessibilityHostMsg_EventParams> /* events */,
     int /* reset_token */)
 
 // Sent to update the browser of the location of accessibility objects.
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_LocationChanges,
     std::vector<AccessibilityHostMsg_LocationChangeParams>)
 
-// Sent to update the browser of the location of accessibility objects.
+// Sent to update the browser of Find In Page results.
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_FindInPageResult,
     AccessibilityHostMsg_FindInPageResultParams)
 
+// Sent in response to AccessibilityMsg_HitTest.
+IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_ChildFrameHitTestResult,
+                    gfx::Point /* location tested */,
+                    int /* node id of result */);
+
 // Sent in response to AccessibilityMsg_SnapshotTree. The callback id that was
 // passed to the request will be returned in |callback_id|, along with
 // a standalone snapshot of the accessibility tree.
 IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_SnapshotResponse,
                     int /* callback_id */,
                     content::AXContentTreeUpdate)