Fix full-screen pepper 3d regression

chrome/browser/gpu_process_host.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/gpu_process_host.h"
 
 #include "app/app_switches.h"
 #include "base/command_line.h"
 #include "base/metrics/histogram.h"
 #include "base/string_piece.h"
 #include "base/threading/thread.h"
 #include "chrome/browser/browser_thread.h"
 #include "chrome/browser/gpu_blacklist.h"
 #include "chrome/browser/gpu_process_host_ui_shim.h"
 #include "chrome/browser/renderer_host/render_message_filter.h"
-#include "chrome/browser/renderer_host/render_view_host.h"
+#include "chrome/browser/renderer_host/render_process_host.h"
+#include "chrome/browser/renderer_host/render_widget_host.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/browser/tab_contents/render_view_host_delegate_helper.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/gpu_feature_flags.h"
 #include "chrome/common/gpu_info.h"
 #include "chrome/common/gpu_messages.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/gpu/gpu_thread.h"
 #include "grit/browser_resources.h"
 #include "ipc/ipc_channel_handle.h"
@@ skipping 219 matching lines @@
 }
 
 void CVCBThreadHopping::GetViewWindow(
     int32 render_view_id,
     int32 renderer_id,
     const GPUCreateCommandBufferConfig& init_params,
     IPC::Message* reply,
     scoped_refptr<RenderMessageFilter> filter) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   gfx::PluginWindowHandle window = gfx::kNullPluginWindow;
-  RenderViewHost* host = RenderViewHost::FromID(renderer_id,
-                                                render_view_id);
+  RenderProcessHost* process = RenderProcessHost::FromID(renderer_id);
+  RenderWidgetHost* host = NULL;
+  if (process) {
+    host = static_cast<RenderWidgetHost*>(

[apatrick_chromium, 2011/02/11 21:59:12]

piman, is this cast safe if the browser does not trust the renderer to pass in
the routing id of a RenderWidgetHost? What if it is an object of a different
class? I am concerned a renderer could use that to crash the browser process.

[piman, 2011/02/11 22:07:52]

I don't know, I assumed the previous code was correct. RenderViewHost::FromID
does the same cast. This code is the same except it doesn't fail if it's not a
RenderViewHost.

[apatrick_chromium, 2011/02/11 22:10:42]

Perhaps the intent of the original code was to call IsRenderView to verify that
it is an object of the right type. That isn't safe though because its a virtual
function. I'll keep digging. Thanks...

+        process->GetListenerByID(render_view_id));
+  }
 #if defined(OS_LINUX)
   gfx::NativeViewId view = NULL;
   if (host)
     view = gfx::IdFromNativeView(host->view()->GetNativeView());
 
   // Lock the window that we will draw into.
   GtkNativeViewManager* manager = GtkNativeViewManager::GetInstance();
   if (!manager->GetPermanentXIDForId(&window, view)) {
     DLOG(ERROR) << "Can't find XID for view id " << view;
   }
@@ skipping 247 matching lines @@
   const CommandLine& browser_command_line = *CommandLine::ForCurrentProcess();
   if (browser_command_line.HasSwitch(switches::kIgnoreGpuBlacklist) ||
       blacklist->LoadGpuBlacklist(gpu_blacklist_json.as_string(), true)) {
     gpu_blacklist_.reset(blacklist);
     return true;
   }
   delete blacklist;
   return false;
 }