Messages needed for webview compositor communication.

content/browser/browser_plugin/browser_plugin_guest.cc

Index: content/browser/browser_plugin/browser_plugin_guest.cc
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index c0a09e6872dc603060c6b5ac8c9c859811f7c50d..357fcadc19d439cc504ab12387f0104177bffb4d 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -233,6 +233,31 @@ void BrowserPluginGuest::SetDamageBuffer(
   damage_buffer_scale_factor_ = scale_factor;
 }
 
+void BrowserPluginGuest::SetCompositingBufferData(int gpu_process_id,

[rjkroege, 2012/11/08 15:08:50]

A compromised renderer process could send invalid values for these. Shouldn't
there be some sort of validation of the values?

[alexst (slow to review), 2012/11/08 18:12:17]

These are validated later in the TextureImageTransportSurface. If any of the
handles don't correspond to a valid object, surface creation fails.

+                                                  uint32 client_id,
+                                                  uint32 context_id,
+                                                  uint32 texture_id_0,
+                                                  uint32 texture_id_1,
+                                                  uint32 sync_point) {
+  // This is the signal for having no context
+  if (texture_id_0 == 0) {
+    DCHECK(texture_id_1 == 0);
+    surface_handle_ = gfx::GLSurfaceHandle();
+    return;
+  }
+
+  DCHECK(texture_id_1 != 0);
+  DCHECK(texture_id_0 != texture_id_1);
+
+  surface_handle_ = gfx::GLSurfaceHandle(gfx::kNullPluginWindow, true);
+  surface_handle_.parent_gpu_process_id = gpu_process_id;
+  surface_handle_.parent_client_id = client_id;
+  surface_handle_.parent_context_id = context_id;
+  surface_handle_.parent_texture_id[0] = texture_id_0;
+  surface_handle_.parent_texture_id[1] = texture_id_1;
+  surface_handle_.sync_point = sync_point;
+}
+
 void BrowserPluginGuest::UpdateRect(
     RenderViewHost* render_view_host,
     const ViewHostMsg_UpdateRect_Params& params) {