Fix race condition causing DCHECK(ack_pending_) to trip.

content/common/accessibility_messages.h

Index: content/common/accessibility_messages.h
diff --git a/content/common/accessibility_messages.h b/content/common/accessibility_messages.h
index dcf40cb43ba3b45c590d8fb55f74fa920e82ae33..abb97a739d7c4cbc77dd5e789085a8d53fb42763 100644
--- a/content/common/accessibility_messages.h
+++ b/content/common/accessibility_messages.h
@@ -184,8 +184,10 @@ IPC_MESSAGE_ROUTED1(AccessibilityMsg_SetAccessibilityFocus,
                     int /* object id */)
 
 // Tells the render view that a AccessibilityHostMsg_Events
-// message was processed and it can send addition events.
-IPC_MESSAGE_ROUTED0(AccessibilityMsg_Events_ACK)
+// message was processed and it can send additional events. The argument
+// must be the same as the ack_token passed to AccessibilityHostMsg_Events.
+IPC_MESSAGE_ROUTED1(AccessibilityMsg_Events_ACK,
+                    int /* ack_token */)
 
 // Tell the renderer to reset and send a new accessibility tree from
 // scratch because the browser is out of sync. It passes a sequential
@@ -210,15 +212,17 @@ IPC_MESSAGE_ROUTED1(AccessibilityMsg_SnapshotTree,
 // Messages sent from the renderer to the browser.
 
 // Sent to notify the browser about renderer accessibility events.
-// The browser responds with a AccessibilityMsg_Events_ACK.
+// The browser responds with a AccessibilityMsg_Events_ACK with the same
+// ack_token.
 // The second parameter, reset_token, is set if this IPC was sent in response
 // to a reset request from the browser. When the browser requests a reset,
 // it ignores incoming IPCs until it sees one with the correct reset token.
 // Any other time, it ignores IPCs with a reset token.
-IPC_MESSAGE_ROUTED2(
+IPC_MESSAGE_ROUTED3(
     AccessibilityHostMsg_Events,
     std::vector<AccessibilityHostMsg_EventParams> /* events */,
-    int /* reset_token */)
+    int /* reset_token */,
+    int /* ack_token */)
 
 // Sent to update the browser of the location of accessibility objects.
 IPC_MESSAGE_ROUTED1(