Messages needed for webview compositor communication.

content/browser/browser_plugin/browser_plugin_guest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/browser_plugin/browser_plugin_guest.h"
 
 #include <algorithm>
 
 #include "base/string_util.h"
 #include "content/browser/browser_plugin/browser_plugin_embedder.h"
@@ skipping 215 matching lines @@
   // between the embedder and browser processes.
   DCHECK(*static_cast<unsigned int*>(damage_buffer->memory()) == 0xdeadbeef);
   damage_buffer_.reset(damage_buffer);
 #if defined(OS_WIN)
   damage_buffer_size_ = damage_buffer_size;
 #endif
   damage_view_size_ = damage_view_size;
   damage_buffer_scale_factor_ = scale_factor;
 }
 
+void BrowserPluginGuest::SetCompositingBufferData(int gpu_process_id,

[rjkroege, 2012/11/08 15:08:50]

A compromised renderer process could send invalid values for these. Shouldn't
there be some sort of validation of the values?

[alexst (slow to review), 2012/11/08 18:12:17]

These are validated later in the TextureImageTransportSurface. If any of the
handles don't correspond to a valid object, surface creation fails.

+                                                  uint32 client_id,
+                                                  uint32 context_id,
+                                                  uint32 texture_id_0,
+                                                  uint32 texture_id_1,
+                                                  uint32 sync_point) {
+  // This is the signal for having no context
+  if (texture_id_0 == 0) {
+    DCHECK(texture_id_1 == 0);
+    surface_handle_ = gfx::GLSurfaceHandle();
+    return;
+  }
+
+  DCHECK(texture_id_1 != 0);
+  DCHECK(texture_id_0 != texture_id_1);
+
+  surface_handle_ = gfx::GLSurfaceHandle(gfx::kNullPluginWindow, true);
+  surface_handle_.parent_gpu_process_id = gpu_process_id;
+  surface_handle_.parent_client_id = client_id;
+  surface_handle_.parent_context_id = context_id;
+  surface_handle_.parent_texture_id[0] = texture_id_0;
+  surface_handle_.parent_texture_id[1] = texture_id_1;
+  surface_handle_.sync_point = sync_point;
+}
+
 void BrowserPluginGuest::UpdateRect(
     RenderViewHost* render_view_host,
     const ViewHostMsg_UpdateRect_Params& params) {
   RenderWidgetHostImpl* render_widget_host =
       RenderWidgetHostImpl::From(render_view_host);
   render_widget_host->ResetSizeAndRepaintPendingFlags();
   // This handler is only of interest to us for the 2D software rendering path.
   // needs_ack should always be true for the 2D path.
   // TODO(fsamuel): Do we need to do something different in the 3D case?
   if (!params.needs_ack)
@@ skipping 260 matching lines @@
     default:
       break;
   }
 }
 
 void BrowserPluginGuest::SendMessageToEmbedder(IPC::Message* msg) {
   embedder_web_contents_->GetRenderProcessHost()->Send(msg);
 }
 
 }  // namespace content