Pepper: add validity checks in RendererPpapiHostImpl::GetDocumentURL

content/renderer/pepper/renderer_ppapi_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/renderer_ppapi_host_impl.h"
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
@@ skipping 241 matching lines @@
     base::MessageLoop::current()->PostTask(
         FROM_HERE,
         base::Bind(callback, std::vector<int>(nested_msgs.size(), 0)));
   } else {
     browser_connection->SendBrowserCreate(
         module_->GetPluginChildId(), instance, nested_msgs, callback);
   }
 }
 
 GURL RendererPpapiHostImpl::GetDocumentURL(PP_Instance instance) const {
-  PepperPluginInstanceImpl* instance_object = GetAndValidateInstance(instance);
-  if (!instance_object || !instance_object->container())
+  blink::WebPluginContainer* container = GetContainerForInstance(instance);
+  if (!container)
     return GURL();
 
-  return instance_object->container()->element().document().url();
+  blink::WebElement element = container->element();
+  if (element.isNull())
+    return GURL();
+
+  blink::WebDocument document = element.document();
+  if (document.isNull())
+    return GURL();
+
+  return document.url();
 }
 
 PepperPluginInstanceImpl* RendererPpapiHostImpl::GetAndValidateInstance(
     PP_Instance pp_instance) const {
   PepperPluginInstanceImpl* instance =
       HostGlobals::Get()->GetInstance(pp_instance);
   if (!instance)
     return NULL;
   if (!instance->IsValidInstanceOf(module_))
     return NULL;
   return instance;
 }
 
 }  // namespace content