Fix two race conditions in web view accessibility

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 2950 matching lines @@
 }
 
 AXTreeIDRegistry::AXTreeID
 RenderFrameHostImpl::BrowserPluginInstanceIDToAXTreeID(
     int instance_id) {
   RenderFrameHostImpl* guest = static_cast<RenderFrameHostImpl*>(
       delegate()->GetGuestByInstanceID(this, instance_id));
   if (!guest)
     return AXTreeIDRegistry::kNoAXTreeID;
 
+  // Create a mapping from the guest to its embedder's AX Tree ID, and
+  // explicitly update the guest to propagate that mapping immediately.
   guest->set_browser_plugin_embedder_ax_tree_id(GetAXTreeID());
+  guest->UpdateAXTreeData();
 
   return guest->GetAXTreeID();
 }
 
 void RenderFrameHostImpl::AXContentNodeDataToAXNodeData(
     const AXContentNodeData& src,
     ui::AXNodeData* dst) {
   // Copy the common fields.
   *dst = src;
 
@@ skipping 62 matching lines @@
   web_bluetooth_service_->SetClientConnectionErrorHandler(base::Bind(
       &RenderFrameHostImpl::DeleteWebBluetoothService, base::Unretained(this)));
   return web_bluetooth_service_.get();
 }
 
 void RenderFrameHostImpl::DeleteWebBluetoothService() {
   web_bluetooth_service_.reset();
 }
 
 }  // namespace content