Track which NativeViewIds each render process is allowed to interact with.

chrome/browser/renderer_host/render_view_host.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_view_host.h"
 
 #include <string>
 #include <vector>
 
 #include "base/gfx/native_widget_types.h"
@@ skipping 149 matching lines @@
       "Couldn't duplicate the modal dialog handle for the renderer.";
 #endif
 
   DCHECK(view());
 
   ModalDialogEvent modal_dialog_event;
 #if defined(OS_WIN)
   modal_dialog_event.event = modal_dialog_event_handle;
 #endif
 
-  Send(new ViewMsg_New(gfx::IdFromNativeView(view()->GetPluginNativeView()),
+  gfx::NativeViewId view_id =
+      gfx::IdFromNativeView(view()->GetPluginNativeView());
+  RendererSecurityPolicy::GetInstance()->GrantNativeViewId(
+      process()->pid(), view_id);
+  Send(new ViewMsg_New(view_id,
                        modal_dialog_event,
                        delegate_->GetWebkitPrefs(),
                        routing_id()));
 
   // Set the alternate error page, which is profile specific, in the renderer.
   GURL url = delegate_->GetAlternateErrorPageURL();
   SetAlternateErrorPageURL(url);
 
   // If it's enabled, tell the renderer to set up the Javascript bindings for
   // sending messages back to the browser.
@@ skipping 1182 matching lines @@
   // TODO(aa): Here is where we can check that this renderer was supposed to be
   // able to call extension APIs.
   DCHECK(extension_function_dispatcher_.get());
   extension_function_dispatcher_->HandleRequest(name, args, callback_id);
 }
 
 void RenderViewHost::SendExtensionResponse(int callback_id,
                                            const std::string& response) {
   Send(new ViewMsg_ExtensionResponse(routing_id(), callback_id, response));
 }