Fix accessible touch exploration inside of iframes.

content/common/accessibility_messages.h

Index: content/common/accessibility_messages.h
diff --git a/content/common/accessibility_messages.h b/content/common/accessibility_messages.h
index 2be32b28e9ef9a67248569f249c2c2f78baff68a..d5fc7bd981208614029cc17e31022b2f83826925 100644
--- a/content/common/accessibility_messages.h
+++ b/content/common/accessibility_messages.h
@@ -159,8 +159,12 @@ IPC_MESSAGE_ROUTED2(AccessibilityMsg_SetValue,
                     int /* object id */,
                     base::string16 /* Value */)
 
-// Determine the accessibility object under a given point and reply with
-// a AccessibilityHostMsg_HitTestResult with the same id.
+// Determine the accessibility object under a given point.
+//
+// If the target is an object with a child frame (like an iframe element),

[nasko, 2016/03/30 21:01:41]

Does this mean that a <div> that has an <iframe> inside can cause this IPC to be
emitted even if the hittest is somewhere in the <div> section that is not the
<iframe>?

[dmazzoni, 2016/03/31 16:15:55]

Sorry if my wording is unclear. I meant that the <iframe> itself is the result
of the
hit test. Similarly if it's a browser plugin <object>. If the result of the hit
test is
a div, we're done.

[nasko, 2016/03/31 16:35:57]

Thanks! This definitely clarifies it.

+// responds with AccessibilityHostMsg_ChildFrameHitTestResult so that the
+// hit test can be performed recursively on the child frame. Otherwise
+// it fires an accessibility event of type ui::AX_EVENT_HOVER on the target.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_HitTest,
                     gfx::Point /* location to test */)
 
@@ -213,11 +217,16 @@ IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_LocationChanges,
     std::vector<AccessibilityHostMsg_LocationChangeParams>)
 
-// Sent to update the browser of the location of accessibility objects.
+// Sent to update the browser of Find In Page results.
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_FindInPageResult,
     AccessibilityHostMsg_FindInPageResultParams)
 
+// Sent in response to AccessibilityMsg_HitTest.
+IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_ChildFrameHitTestResult,
+                    gfx::Point /* location tested */,
+                    int /* node id of result */);
+
 // Sent in response to AccessibilityMsg_SnapshotTree. The callback id that was
 // passed to the request will be returned in |callback_id|, along with
 // a standalone snapshot of the accessibility tree.