Fix race condition causing DCHECK(ack_pending_) to trip.

content/common/accessibility_messages.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // IPC messages for accessibility.
 // Multiply-included message file, hence no include guard.
 
 #include "content/common/ax_content_node_data.h"
 #include "content/common/content_export.h"
 #include "content/common/view_message_enums.h"
@@ skipping 166 matching lines @@
                     gfx::Point /* location to test */)
 
 // Relay a request from assistive technology to set accessibility focus
 // to a given node. On platforms where this is used (currently Android),
 // inline text boxes are only computed for the node with accessibility focus,
 // rather than for the whole tree.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_SetAccessibilityFocus,
                     int /* object id */)
 
 // Tells the render view that a AccessibilityHostMsg_Events
-// message was processed and it can send addition events.
-IPC_MESSAGE_ROUTED0(AccessibilityMsg_Events_ACK)
+// message was processed and it can send additional events. The argument
+// must be the same as the ack_token passed to AccessibilityHostMsg_Events.
+IPC_MESSAGE_ROUTED1(AccessibilityMsg_Events_ACK,
+                    int /* ack_token */)
 
 // Tell the renderer to reset and send a new accessibility tree from
 // scratch because the browser is out of sync. It passes a sequential
 // reset token. This should be rare, and if we need reset the same renderer
 // too many times we just kill it. After sending a reset, the browser ignores
 // incoming accessibility IPCs until it receives one with the matching reset
 // token. Conversely, it ignores IPCs with a reset token if it was not
 // expecting a reset.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_Reset,
                     int /* reset token */)
 
 // Kill the renderer because we got a fatal error in the accessibility tree
 // and we've already reset too many times.
 IPC_MESSAGE_ROUTED0(AccessibilityMsg_FatalError)
 
 // Request a one-time snapshot of the accessibility tree without
 // enabling accessibility if it wasn't already enabled. The passed id
 // will be returned in the AccessibilityHostMsg_SnapshotResponse message.
 IPC_MESSAGE_ROUTED1(AccessibilityMsg_SnapshotTree,
                     int /* callback id */)
 
 // Messages sent from the renderer to the browser.
 
 // Sent to notify the browser about renderer accessibility events.
-// The browser responds with a AccessibilityMsg_Events_ACK.
+// The browser responds with a AccessibilityMsg_Events_ACK with the same
+// ack_token.
 // The second parameter, reset_token, is set if this IPC was sent in response
 // to a reset request from the browser. When the browser requests a reset,
 // it ignores incoming IPCs until it sees one with the correct reset token.
 // Any other time, it ignores IPCs with a reset token.
-IPC_MESSAGE_ROUTED2(
+IPC_MESSAGE_ROUTED3(
     AccessibilityHostMsg_Events,
     std::vector<AccessibilityHostMsg_EventParams> /* events */,
-    int /* reset_token */)
+    int /* reset_token */,
+    int /* ack_token */)
 
 // Sent to update the browser of the location of accessibility objects.
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_LocationChanges,
     std::vector<AccessibilityHostMsg_LocationChangeParams>)
 
 // Sent to update the browser of Find In Page results.
 IPC_MESSAGE_ROUTED1(
     AccessibilityHostMsg_FindInPageResult,
     AccessibilityHostMsg_FindInPageResultParams)
 
 // Sent in response to AccessibilityMsg_HitTest.
 IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_ChildFrameHitTestResult,
                     gfx::Point /* location tested */,
                     int /* node id of result */)
 
 // Sent in response to AccessibilityMsg_SnapshotTree. The callback id that was
 // passed to the request will be returned in |callback_id|, along with
 // a standalone snapshot of the accessibility tree.
 IPC_MESSAGE_ROUTED2(AccessibilityHostMsg_SnapshotResponse,
                     int /* callback_id */,
                     content::AXContentTreeUpdate)