Make sandboxed Flash work under UIPI

webkit/plugins/npapi/webplugin_delegate_impl_win.cc

Index: webkit/plugins/npapi/webplugin_delegate_impl_win.cc
===================================================================
--- webkit/plugins/npapi/webplugin_delegate_impl_win.cc	(revision 87939)
+++ webkit/plugins/npapi/webplugin_delegate_impl_win.cc	(working copy)
@@ -274,6 +274,7 @@
       handle_event_message_filter_hook_(NULL),
       handle_event_pump_messages_event_(NULL),
       user_gesture_message_posted_(false),
+      is_builtin_flash_(false),
 #pragma warning(suppress: 4355)  // can use this
       user_gesture_msg_factory_(this),
       handle_event_depth_(0),
@@ -289,7 +290,9 @@
   std::wstring filename =
       StringToLowerASCII(plugin_info.path.BaseName().value());
 
-  if (instance_->mime_type() == "application/x-shockwave-flash" ||
+  is_builtin_flash_ = filename == kBuiltinFlashPlugin;
+  if (is_builtin_flash_ ||
+      instance_->mime_type() == "application/x-shockwave-flash" ||
       filename == kFlashPlugin) {
     // Flash only requests windowless plugins if we return a Mozilla user
     // agent.
@@ -354,7 +357,11 @@
 
 WebPluginDelegateImpl::~WebPluginDelegateImpl() {
   if (::IsWindow(dummy_window_for_activation_)) {
-    ::DestroyWindow(dummy_window_for_activation_);
+    // Sandboxed Flash stacks two dummy windows to prevent UIPI failures
+    if (is_builtin_flash_)
+      ::DestroyWindow(::GetParent(dummy_window_for_activation_));

[ananta, 2011/06/06 22:37:10]

We could maintain the dummy parent as a member variable. Feels creepy to destroy
a window via the GetParent call. Imagine a case where a window somehow sneaks
between us and the dummy activation window. :(

+    else
+      ::DestroyWindow(dummy_window_for_activation_);
   }
 
   DestroyInstance();
@@ -492,14 +499,16 @@
       0,
       0,
       0,
-      parent_,
+      is_builtin_flash_ ? NULL : parent_,
       0,
       GetModuleHandle(NULL),
       0);
   if (windowed_handle_ == 0)
     return false;
 
-  if (IsWindow(parent_)) {
+  if (is_builtin_flash_) {
+    plugin_->ReparentPluginWindow(windowed_handle_, parent_);
+  } else if (IsWindow(parent_)) {
     // This is a tricky workaround for Issue 2673 in chromium "Flash: IME not
     // available". To use IMEs in this window, we have to make Windows attach
     // IMEs to this window (i.e. load IME DLLs, attach them to this process,
@@ -709,12 +718,12 @@
     0,
     L"Static",
     kDummyActivationWindowName,
-    WS_CHILD,
+    is_builtin_flash_ ? WS_POPUP : WS_CHILD,
     0,
     0,
     0,
     0,
-    parent_,
+    is_builtin_flash_ ? 0 : parent_,
     0,
     GetModuleHandle(NULL),
     0);
@@ -722,6 +731,31 @@
   if (dummy_window_for_activation_ == 0)
     return false;
 
+  if (is_builtin_flash_) {
+    // Built-in Flash runs with UIPI, but in windowless mode Flash sometimes
+    // tries to attach windows to the parent (which fails under UIPI). To make
+    // it work we add an extra dummy parent in the low-integrity process.
+    HWND parent_proxy_window = CreateWindowEx(
+      0,
+      L"Static",
+      kDummyActivationWindowName,
+      WS_POPUP,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      GetModuleHandle(NULL),

[ananta, 2011/06/06 22:37:10]

We could create the dummy parent window before creating the activation window?.
We could then pass the dummy hwnd as the parent in the CreateWindow call.

+      0);
+
+    if (parent_proxy_window == 0 ||
+        ::SetParent(dummy_window_for_activation_, parent_proxy_window) == 0)
+      return false;
+
+    plugin_->ReparentPluginWindow(parent_proxy_window, parent_);
+  }
+
   // Flash creates background windows which use excessive CPU in our
   // environment; we wrap these windows and throttle them so that they don't
   // get out of hand.