Fix race condition causing DCHECK(ack_pending_) to trip.

content/renderer/accessibility/render_accessibility_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/accessibility/render_accessibility_impl.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <queue>
@@ skipping 22 matching lines @@
 using blink::WebElement;
 using blink::WebFloatRect;
 using blink::WebLocalFrame;
 using blink::WebNode;
 using blink::WebPoint;
 using blink::WebRect;
 using blink::WebScopedAXContext;
 using blink::WebSettings;
 using blink::WebView;
 
+namespace {
+// The next token to use to distinguish between ack events sent to this
+// RenderAccessibilityImpl and a previous instance.
+static int g_next_ack_token = 1;
+}
+
 namespace content {
 
 // Cap the number of nodes returned in an accessibility
 // tree snapshot to avoid outrageous memory or bandwidth
 // usage.
 const size_t kMaxSnapshotNodeCount = 5000;
 
 // static
 void RenderAccessibilityImpl::SnapshotAccessibilityTree(
     RenderFrameImpl* render_frame,
@@ skipping 19 matching lines @@
 RenderAccessibilityImpl::RenderAccessibilityImpl(RenderFrameImpl* render_frame)
     : RenderFrameObserver(render_frame),
       render_frame_(render_frame),
       tree_source_(render_frame),
       serializer_(&tree_source_),
       pdf_tree_source_(nullptr),
       last_scroll_offset_(gfx::Size()),
       ack_pending_(false),
       reset_token_(0),
       weak_factory_(this) {
+  ack_token_ = g_next_ack_token++;

[David Tseng, 2016/09/14 02:49:42]

Perhaps dumb question, but is this global shared across processes?

[dmazzoni, 2016/09/14 18:58:03]

No, but it doesn't need to be. The only issue is when the same RenderFrameHost
deletes and creates a new RenderAccessibilityImpl, so it only needs to be global
within this render process.

   WebView* web_view = render_frame_->GetRenderView()->GetWebView();
   WebSettings* settings = web_view->settings();
   settings->setAccessibilityEnabled(true);
 
 #if defined(OS_ANDROID)
   // Password values are only passed through on Android.
   settings->setAccessibilityPasswordValuesEnabled(true);
 #endif
 
 #if !defined(OS_ANDROID)
@@ skipping 252 matching lines @@
       dst.transform.reset(nullptr);
       if (src.transform)
         dst.transform.reset(new gfx::Transform(*src.transform));
     }
 
     DVLOG(0) << "Accessibility event: " << ui::ToString(event.event_type)
              << " on node id " << event_msg.id
              << "\n" << event_msg.update.ToString();
   }
 
-  Send(new AccessibilityHostMsg_Events(routing_id(), event_msgs, reset_token_));
+  Send(new AccessibilityHostMsg_Events(routing_id(), event_msgs, reset_token_,
+                                       ack_token_));
   reset_token_ = 0;
 
   if (had_layout_complete_messages)
     SendLocationChanges();
 }
 
 void RenderAccessibilityImpl::SendLocationChanges() {
   std::vector<AccessibilityHostMsg_LocationChangeParams> messages;
 
   // Update layout on the root of the tree.
@@ skipping 59 matching lines @@
   if (obj.isDetached()) {
 #ifndef NDEBUG
     LOG(WARNING) << "DoDefaultAction on invalid object id " << acc_obj_id;
 #endif
     return;
   }
 
   obj.performDefaultAction();
 }
 
-void RenderAccessibilityImpl::OnEventsAck() {
+void RenderAccessibilityImpl::OnEventsAck(int ack_token) {
+  // Ignore acks intended for a different or previous instance.
+  if (ack_token_ != ack_token)
+    return;
+
   DCHECK(ack_pending_);
   ack_pending_ = false;
   SendPendingAccessibilityEvents();
 }
 
 void RenderAccessibilityImpl::OnFatalError() {
   CHECK(false) << "Invalid accessibility tree.";
 }
 
 void RenderAccessibilityImpl::OnHitTest(gfx::Point point) {
@@ skipping 245 matching lines @@
       size_t new_count = pdf_update.nodes.size();
       update->nodes.resize(old_count + new_count);
       for (size_t i = 0; i < new_count; ++i)
         update->nodes[old_count + i] = pdf_update.nodes[i];
       break;
     }
   }
 }
 
 }  // namespace content