Track which NativeViewIds each render process is allowed to interact with.

chrome/browser/renderer_host/resource_message_filter_mac.mm

Index: chrome/browser/renderer_host/resource_message_filter_mac.mm
===================================================================
--- chrome/browser/renderer_host/resource_message_filter_mac.mm	(revision 14874)
+++ chrome/browser/renderer_host/resource_message_filter_mac.mm	(working copy)
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "chrome/browser/renderer_host/renderer_security_policy.h"
 #include "chrome/browser/renderer_host/resource_message_filter.h"
 #include "chrome/common/render_messages.h"
 
@@ -25,6 +26,12 @@
 
 void ResourceMessageFilter::OnGetWindowRect(gfx::NativeViewId window_id,
                                             IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), window_id)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   NSView* view = gfx::NativeViewFromId(window_id);
   gfx::Rect rect;
 
@@ -41,6 +48,12 @@
 
 void ResourceMessageFilter::OnGetRootWindowRect(gfx::NativeViewId window_id,
                                                 IPC::Message* reply_msg) {
+  RendererSecurityPolicy* policy = RendererSecurityPolicy::GetInstance();
+  if (!policy->HasNativeViewId(GetProcessId(), window_id)) {
+    NOTREACHED() << "Bad NativeViewId from render process.";
+    return;
+  }
+
   NSView* view = gfx::NativeViewFromId(window_id);
   gfx::Rect rect;
   if (view) {