Reset accessibility if it gets out of sync.

content/browser/frame_host/render_frame_host_impl.h

Index: content/browser/frame_host/render_frame_host_impl.h
diff --git a/content/browser/frame_host/render_frame_host_impl.h b/content/browser/frame_host/render_frame_host_impl.h
index a59b5c9770a0885cac7335cdd9e80b45d25f31cf..d26dc024b02ea7132063575577c475120d90fba6 100644
--- a/content/browser/frame_host/render_frame_host_impl.h
+++ b/content/browser/frame_host/render_frame_host_impl.h
@@ -339,6 +339,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // NULL.
   BrowserAccessibilityManager* GetOrCreateBrowserAccessibilityManager();
 
+  void set_disallow_browser_accessibility_manager_for_testing(bool flag) {
+    disallow_browser_accessibility_manager_for_testing_ = flag;
+  }
+
 #if defined(OS_WIN)
   void SetParentNativeViewAccessible(
       gfx::NativeViewAccessible accessible_parent);
@@ -358,6 +362,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
                         const CommonNavigationParams& common_params,
                         const CommitNavigationParams& commit_params);
 
+  // An accessibility reset is only allowed to prevent very rare corner cases
+  // or race conditions where the browser and renderer get out of sync. If
+  // this happens more than this many times, kill the renderer.
+  static const int kMaxAccessibilityResets = 5;

[nasko, 2014/10/06 16:39:03]

Please move this up next to the enum at the beginning of the class.

[dmazzoni, 2014/10/06 16:44:02]

Done.

+
  protected:
   friend class RenderFrameHostFactory;
 
@@ -430,7 +439,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void OnBeginNavigation(const FrameHostMsg_BeginNavigation_Params& params,
                          const CommonNavigationParams& common_params);
   void OnAccessibilityEvents(
-      const std::vector<AccessibilityHostMsg_EventParams>& params);
+      const std::vector<AccessibilityHostMsg_EventParams>& params,
+      int reset_token);
   void OnAccessibilityLocationChanges(
       const std::vector<AccessibilityHostMsg_LocationChangeParams>& params);
 
@@ -558,12 +568,24 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   ServiceRegistryImpl service_registry_;
 
+  // The object managing the accessibility tree for this frame.
   scoped_ptr<BrowserAccessibilityManager> browser_accessibility_manager_;
 
+  // This is nonzero if we sent an accessibility reset to the renderer and
+  // we're waiting for an IPC containing this reset token (sequentially
+  // assigned) and a complete replacement accessibility tree.
+  int accessibility_reset_token_;
+
+  // A count of the number of times we needed to reset accessibility, so
+  // we don't keep trying to reset forever.
+  int accessibility_reset_count_;
+
   // Callback when an event is received, for testing.
   base::Callback<void(ui::AXEvent, int)> accessibility_testing_callback_;
   // The most recently received accessibility tree - for testing only.
   scoped_ptr<ui::AXTree> ax_tree_for_testing_;
+  // Flag to not create a BrowserAccessibilityManager, for testing.
+  bool disallow_browser_accessibility_manager_for_testing_;
 
   // NOTE: This must be the last member.
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_;