Don't send tab switching/killing/creating keyboard accelerators to pages. Th...

chrome/browser/renderer_host/render_widget_host.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host.h"
 
 #include "base/histogram.h"
 #include "base/message_loop.h"
 #include "base/keyboard_codes.h"
 #include "chrome/browser/renderer_host/backing_store.h"
@@ skipping 382 matching lines @@
     OnUserGesture();
   }
 
   // Double check the type to make sure caller hasn't sent us nonsense that
   // will mess up our key queue.
   if (WebInputEvent::isKeyboardEventType(key_event.type)) {
     // Don't add this key to the queue if we have no way to send the message...
     if (!process_->HasConnection())
       return;
 
+    // Tab switching/closing accelerators aren't sent to the renderer to avoid a
+    // hung/malicious renderer from interfering.
+    if (!ShouldSendToRenderer(key_event)) {
+      UnhandledKeyboardEvent(key_event);
+      return;
+    }
+
     // Put all WebKeyboardEvent objects in a queue since we can't trust the
     // renderer and we need to give something to the UnhandledInputEvent
     // handler.
     key_queue_.push(key_event);
     HISTOGRAM_COUNTS_100("Renderer.KeyboardQueueSize", key_queue_.size());
   }
 
   // Only forward the non-native portions of our event.
   ForwardInputEvent(key_event, sizeof(WebKeyboardEvent));
 }
@@ skipping 334 matching lines @@
                  << "don't seem to have sent it to the renderer!";
     } else if (key_queue_.front().type != type) {
       LOG(ERROR) << "We seem to have a different key type sent from "
                  << "the renderer. (" << key_queue_.front().type << " vs. "
                  << type << "). Ignoring event.";
     } else {
       bool processed = false;
       if (!message.ReadBool(&iter, &processed))
         process()->ReceivedBadMessage(message.type());
 
-      KeyQueue::value_type front_item = key_queue_.front();
+      NativeWebKeyboardEvent front_item = key_queue_.front();
       key_queue_.pop();
 
       if (!processed) {
         UnhandledKeyboardEvent(front_item);
 
         // WARNING: This RenderWidgetHost can be deallocated at this point
         // (i.e.  in the case of Ctrl+W, where the call to
         // UnhandledKeyboardEvent destroys this RenderWidgetHost).
       }
     }
@@ skipping 124 matching lines @@
   Send(new ViewMsg_ToggleSpellPanel(routing_id(), is_currently_visible));
 }
 
 void RenderWidgetHost::ReplaceWord(const std::wstring& word) {
   Send(new ViewMsg_Replace(routing_id_, word));
 }
 
 void RenderWidgetHost::AdvanceToNextMisspelling() {
   Send(new ViewMsg_AdvanceToNextMisspelling(routing_id_));
 }