Fix race condition causing DCHECK(ack_pending_) to trip.

content/renderer/accessibility/render_accessibility_impl.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 #define CONTENT_RENDERER_ACCESSIBILITY_RENDER_ACCESSIBILITY_IMPL_H_
 
 #include <vector>
 
 #include "base/containers/hash_tables.h"
@@ skipping 97 matching lines @@
 
   // The RenderFrameImpl that owns us.
   RenderFrameImpl* render_frame_;
 
  private:
   // RenderFrameObserver implementation.
   void OnDestruct() override;
 
   // Handlers for messages from the browser to the renderer.
   void OnDoDefaultAction(int acc_obj_id);
-  void OnEventsAck();
+  void OnEventsAck(int ack_token);
   void OnFatalError();
   void OnHitTest(gfx::Point point);
   void OnSetAccessibilityFocus(int acc_obj_id);
   void OnReset(int reset_token);
   void OnScrollToMakeVisible(int acc_obj_id, gfx::Rect subfocus);
   void OnScrollToPoint(int acc_obj_id, gfx::Point point);
   void OnSetScrollOffset(int acc_obj_id, gfx::Point offset);
   void OnSetFocus(int acc_obj_id);
   void OnSetSelection(int anchor_acc_obj_id,
                       int anchor_offset,
@@ skipping 35 matching lines @@
   // Set if we are waiting for an accessibility event ack.
   bool ack_pending_;
 
   // Nonzero if the browser requested we reset the accessibility state.
   // We need to return this token in the next IPC.
   int reset_token_;
 
   // Whether we are processing a client-initiated action.
   bool during_action_;
 
+  // Token to send with event messages so we know when they're acknowledged.
+  int ack_token_;
+
   // So we can queue up tasks to be executed later.
   base::WeakPtrFactory<RenderAccessibilityImpl> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderAccessibilityImpl);
 };
 
 }  // namespace content
 
 #endif  // CONTENT_RENDERER_ACCESSIBILITY_RENDERER_ACCESSIBILITY_H_