Mark HandleAXEvents as UnlimitedSize

As seen in crbug.com/1088484, we used to see crashes when accessibility
mojo payloads exceeded the limit of 128MB. There is ongoing
investigation into reducing the size of the payload, but in the meantime
we'll be marking the method as [UnlimitedSize].

R=dmazzoni@chromium.org, rockot@chromium.org

Bug: 1088484
Change-Id: Iad3ab62ca6095a3b158ccb7a05d4234d64e8ac6d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2369443
Commit-Queue: Daniel Libby <dlibby@microsoft.com>
Reviewed-by: Dominick Ng <dominickn@chromium.org>
Reviewed-by: Ken Rockot <rockot@google.com>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#801257}

content/common/render_accessibility.mojom

@@ -48,10 +48,21 @@ interface RenderAccessibilityHost {
   // reset request from the browser. When the browser requests a reset, it
   // ignores incoming remote calls until it sees one with the correct reset
   // token. Any other time, it ignores further calls with a reset token.
+  //
+  // The accessibility information sent to the browser is dependent on both
+  // the number of nodes in the DOM (and their accessibility metadata) as well
+  // as the number of changes that generate events. Therefore, this payload can
+  // become arbitrarily large.
+  // TODO(crbug.com/1088484) tracks work to improve the payload size.
+  [UnlimitedSize]
   HandleAXEvents(array<ax.mojom.AXTreeUpdate> updates,
                  array<ax.mojom.AXEvent> events, int32 reset_token) => ();
 
   // Sent to update the browser of the location of accessibility objects.
+  // Similar to HandleAXEvents, the message size is also unbounded (though in
+  // practice these message sizes are quite a bit smaller than HandleAXEvents).
+  // TODO(crbug.com/1088484) tracks work to improve the payload size.
+  [UnlimitedSize]
   HandleAXLocationChanges(array<LocationChanges> changes);
 };