Fix full-screen pepper 3d regression

Fix full-screen pepper 3d regression

Introduced by http://codereview.chromium.org/6343006
Not all RenderWidgetHosts are RenderViewHosts.

BUG=broken 3d on full-screen pepper flash
TEST=pepper flash

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=72998

[jonathan.backer, 2011-01-28 14:12:08]

LGTM.

[apatrick_chromium, 2011-02-11 21:59:12]

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host.cc
File chrome/browser/gpu_process_host.cc (right):

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host...
chrome/browser/gpu_process_host.cc:260: host = static_cast<RenderWidgetHost*>(
piman, is this cast safe if the browser does not trust the renderer to pass in
the routing id of a RenderWidgetHost? What if it is an object of a different
class? I am concerned a renderer could use that to crash the browser process.

[piman, 2011-02-11 22:07:52]

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host.cc
File chrome/browser/gpu_process_host.cc (right):

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host...
chrome/browser/gpu_process_host.cc:260: host = static_cast<RenderWidgetHost*>(
On 2011/02/11 21:59:12, apatrick_chromium wrote:
> piman, is this cast safe if the browser does not trust the renderer to pass in
> the routing id of a RenderWidgetHost? What if it is an object of a different
> class? I am concerned a renderer could use that to crash the browser process.

I don't know, I assumed the previous code was correct. RenderViewHost::FromID
does the same cast. This code is the same except it doesn't fail if it's not a
RenderViewHost.

[apatrick_chromium, 2011-02-11 22:10:42]

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host.cc
File chrome/browser/gpu_process_host.cc (right):

http://codereview.chromium.org/6258023/diff/1/chrome/browser/gpu_process_host...
chrome/browser/gpu_process_host.cc:260: host = static_cast<RenderWidgetHost*>(
On 2011/02/11 22:07:52, piman wrote:
> On 2011/02/11 21:59:12, apatrick_chromium wrote:
> > piman, is this cast safe if the browser does not trust the renderer to pass
in
> > the routing id of a RenderWidgetHost? What if it is an object of a different
> > class? I am concerned a renderer could use that to crash the browser
process.
> 
> I don't know, I assumed the previous code was correct. RenderViewHost::FromID
> does the same cast. This code is the same except it doesn't fail if it's not a
> RenderViewHost.

Perhaps the intent of the original code was to call IsRenderView to verify that
it is an object of the right type. That isn't safe though because its a virtual
function. I'll keep digging. Thanks...