Validate HWNDs that the renderer asks to be moved.

chrome/browser/renderer_host/render_widget_host_view_win.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host_view_win.h"
 
 #include "base/command_line.h"
 #include "base/gfx/gdi_util.h"
 #include "base/gfx/rect.h"
 #include "base/histogram.h"
@@ skipping 147 matching lines @@
   for (size_t i = 0; i < plugin_window_moves.size(); ++i) {
     unsigned long flags = 0;
     const WebPluginGeometry& move = plugin_window_moves[i];
 
     // As the plugin parent window which lives on the browser UI thread is
     // destroyed asynchronously, it is possible that we have a stale window
     // sent in by the renderer for moving around.
     if (!::IsWindow(move.window))
       continue;
 
+    // The renderer should only be trying to move windows that are children
+    // of its render widget window.
+    if (::IsChild(m_hWnd, move.window) == 0) {

[jam, 2009/02/12 19:27:26]

If we're doing this check, we don't need the IsWindow above.

nit: I think (IsChild()) is sufficient and more consistent with the rest of the
code than (IsChild() == 0)

+      NOTREACHED();
+      continue;
+    }
+
     if (move.visible)
       flags |= SWP_SHOWWINDOW;
     else
       flags |= SWP_HIDEWINDOW;
 
     HRGN hrgn = ::CreateRectRgn(move.clip_rect.x(),
                                 move.clip_rect.y(),
                                 move.clip_rect.right(),
                                 move.clip_rect.bottom());
     gfx::SubtractRectanglesFromRegion(hrgn, move.cutout_rects);
@@ skipping 794 matching lines @@
     // WM_LBUTTONDOWN.
     SetFocus();
   }
 }
 
 void RenderWidgetHostViewWin::ShutdownHost() {
   shutdown_factory_.RevokeAll();
   render_widget_host_->Shutdown();
   // Do not touch any members at this point, |this| has been deleted.
 }