Fix race condition causing DCHECK(ack_pending_) to trip.

content/renderer/accessibility/render_accessibility_impl.cc

Index: content/renderer/accessibility/render_accessibility_impl.cc
diff --git a/content/renderer/accessibility/render_accessibility_impl.cc b/content/renderer/accessibility/render_accessibility_impl.cc
index 74e35013b4fc00b461cd3ed2b5d03c84aa3de3c8..f22ec1c04755b9fc135a51a2f41803b01b9f6155 100644
--- a/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/content/renderer/accessibility/render_accessibility_impl.cc
@@ -40,6 +40,12 @@ using blink::WebScopedAXContext;
 using blink::WebSettings;
 using blink::WebView;
 
+namespace {
+// The next token to use to distinguish between ack events sent to this
+// RenderAccessibilityImpl and a previous instance.
+static int g_next_ack_token = 1;
+}
+
 namespace content {
 
 // Cap the number of nodes returned in an accessibility
@@ -79,6 +85,7 @@ RenderAccessibilityImpl::RenderAccessibilityImpl(RenderFrameImpl* render_frame)
       ack_pending_(false),
       reset_token_(0),
       weak_factory_(this) {
+  ack_token_ = g_next_ack_token++;

[David Tseng, 2016/09/14 02:49:42]

Perhaps dumb question, but is this global shared across processes?

[dmazzoni, 2016/09/14 18:58:03]

No, but it doesn't need to be. The only issue is when the same RenderFrameHost
deletes and creates a new RenderAccessibilityImpl, so it only needs to be global
within this render process.

   WebView* web_view = render_frame_->GetRenderView()->GetWebView();
   WebSettings* settings = web_view->settings();
   settings->setAccessibilityEnabled(true);
@@ -351,7 +358,8 @@ void RenderAccessibilityImpl::SendPendingAccessibilityEvents() {
              << "\n" << event_msg.update.ToString();
   }
 
-  Send(new AccessibilityHostMsg_Events(routing_id(), event_msgs, reset_token_));
+  Send(new AccessibilityHostMsg_Events(routing_id(), event_msgs, reset_token_,
+                                       ack_token_));
   reset_token_ = 0;
 
   if (had_layout_complete_messages)
@@ -431,7 +439,11 @@ void RenderAccessibilityImpl::OnDoDefaultAction(int acc_obj_id) {
   obj.performDefaultAction();
 }
 
-void RenderAccessibilityImpl::OnEventsAck() {
+void RenderAccessibilityImpl::OnEventsAck(int ack_token) {
+  // Ignore acks intended for a different or previous instance.
+  if (ack_token_ != ack_token)
+    return;
+
   DCHECK(ack_pending_);
   ack_pending_ = false;
   SendPendingAccessibilityEvents();