| Index: content/browser/renderer_host/render_message_filter.cc
|
| ===================================================================
|
| --- content/browser/renderer_host/render_message_filter.cc (revision 166155)
|
| +++ content/browser/renderer_host/render_message_filter.cc (working copy)
|
| @@ -688,22 +688,42 @@
|
| void RenderMessageFilter::OnDidCreateOutOfProcessPepperInstance(
|
| int plugin_child_id,
|
| int32 pp_instance,
|
| - int render_view_id) {
|
| + int render_view_id,
|
| + bool is_external) {
|
| // It's important that we supply the render process ID ourselves based on the
|
| // channel the message arrived on. We use the
|
| // PP_Instance -> (process id, view id)
|
| // mapping to decide how to handle messages received from the (untrusted)
|
| // plugin, so an exploited renderer must not be able to insert fake mappings
|
| // that may allow it access to other render processes.
|
| - PpapiPluginProcessHost::DidCreateOutOfProcessInstance(
|
| - plugin_child_id, pp_instance, render_process_id_, render_view_id);
|
| + if (is_external) {
|
| + // We provide the BrowserPpapiHost to the embedder, so it's safe to cast.
|
| + BrowserPpapiHostImpl* host = static_cast<BrowserPpapiHostImpl*>(
|
| + GetContentClient()->browser()->GetExternalBrowserPpapiHost(
|
| + plugin_child_id));
|
| + if (host)
|
| + host->AddInstanceForView(pp_instance, render_process_id_, render_view_id);
|
| + } else {
|
| + PpapiPluginProcessHost::DidCreateOutOfProcessInstance(
|
| + plugin_child_id, pp_instance, render_process_id_, render_view_id);
|
| + }
|
| }
|
|
|
| void RenderMessageFilter::OnDidDeleteOutOfProcessPepperInstance(
|
| int plugin_child_id,
|
| - int32 pp_instance) {
|
| - PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(
|
| - plugin_child_id, pp_instance);
|
| + int32 pp_instance,
|
| + bool is_external) {
|
| + if (is_external) {
|
| + // We provide the BrowserPpapiHost to the embedder, so it's safe to cast.
|
| + BrowserPpapiHostImpl* host = static_cast<BrowserPpapiHostImpl*>(
|
| + GetContentClient()->browser()->GetExternalBrowserPpapiHost(
|
| + plugin_child_id));
|
| + if (host)
|
| + host->DeleteInstanceForView(pp_instance);
|
| + } else {
|
| + PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(
|
| + plugin_child_id, pp_instance);
|
| + }
|
| }
|
|
|
| void RenderMessageFilter::OnOpenChannelToPpapiBroker(int routing_id,
|
|
|