Fix full-screen pepper 3d regression

chrome/browser/gpu_process_host.cc

Index: chrome/browser/gpu_process_host.cc
diff --git a/chrome/browser/gpu_process_host.cc b/chrome/browser/gpu_process_host.cc
index b41ef44c13ca5e0264aad06b738452a8692bab3a..91906afbabdb686108b70dbc19f2cb7ee2ed9329 100644
--- a/chrome/browser/gpu_process_host.cc
+++ b/chrome/browser/gpu_process_host.cc
@@ -13,7 +13,8 @@
 #include "chrome/browser/gpu_blacklist.h"
 #include "chrome/browser/gpu_process_host_ui_shim.h"
 #include "chrome/browser/renderer_host/render_message_filter.h"
-#include "chrome/browser/renderer_host/render_view_host.h"
+#include "chrome/browser/renderer_host/render_process_host.h"
+#include "chrome/browser/renderer_host/render_widget_host.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/browser/tab_contents/render_view_host_delegate_helper.h"
 #include "chrome/common/chrome_switches.h"
@@ -253,8 +254,12 @@ void CVCBThreadHopping::GetViewWindow(
     scoped_refptr<RenderMessageFilter> filter) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   gfx::PluginWindowHandle window = gfx::kNullPluginWindow;
-  RenderViewHost* host = RenderViewHost::FromID(renderer_id,
-                                                render_view_id);
+  RenderProcessHost* process = RenderProcessHost::FromID(renderer_id);
+  RenderWidgetHost* host = NULL;
+  if (process) {
+    host = static_cast<RenderWidgetHost*>(

[apatrick_chromium, 2011/02/11 21:59:12]

piman, is this cast safe if the browser does not trust the renderer to pass in
the routing id of a RenderWidgetHost? What if it is an object of a different
class? I am concerned a renderer could use that to crash the browser process.

[piman, 2011/02/11 22:07:52]

I don't know, I assumed the previous code was correct. RenderViewHost::FromID
does the same cast. This code is the same except it doesn't fail if it's not a
RenderViewHost.

[apatrick_chromium, 2011/02/11 22:10:42]

Perhaps the intent of the original code was to call IsRenderView to verify that
it is an object of the right type. That isn't safe though because its a virtual
function. I'll keep digging. Thanks...

+        process->GetListenerByID(render_view_id));
+  }
 #if defined(OS_LINUX)
   gfx::NativeViewId view = NULL;
   if (host)