Resend unconsumed scroll update from guest back to embedder (WebView Scroll Bubble).

content/browser/browser_plugin/browser_plugin_guest.cc

Index: content/browser/browser_plugin/browser_plugin_guest.cc
diff --git a/content/browser/browser_plugin/browser_plugin_guest.cc b/content/browser/browser_plugin/browser_plugin_guest.cc
index bb41b7e34347d8c758b9070b78dae2314bf9bcc9..12bdfc1a5d24a09ae29fa3afd7db20347d5dbc9d 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.cc
+++ b/content/browser/browser_plugin/browser_plugin_guest.cc
@@ -459,6 +459,33 @@ bool BrowserPluginGuest::StopFinding(StopFindAction action) {
   return delegate_->StopFinding(action);
 }
 
+void BrowserPluginGuest::ResendEventToEmbedder(
+    const blink::WebInputEvent& event) {
+  if (!attached() || !owner_web_contents_)
+    return;
+
+  DCHECK(browser_plugin_instance_id_);
+  RenderWidgetHostImpl* host =
+      embedder_web_contents()->GetMainFrame()->GetRenderWidgetHost();
+
+  if (event.type == blink::WebInputEvent::GestureScrollUpdate) {
+    blink::WebGestureEvent resent_gesture_event;
+    memcpy(&resent_gesture_event, &event, sizeof(blink::WebGestureEvent));

[Charlie Reis, 2015/09/18 04:30:36]

Sigh.  memcpy is pretty dangerous in general, and I don't like that we're
choosing the size based on the event.type parameter from the renderer process. 
I suppose it seems safe the way it's used here, though, since we won't copy any
more than the size of the destination.

[wjmaclean, 2015/09/18 15:30:57]

Acknowledged.

I used it based on seeing the pattern elsewhere. I guess the main issue is
trusting the event type (and content?) since it's sent from the renderer ...
after that the method of copying (if done properly) doesn't matter, is that
right? 

+    // Mark the resend source with the browser plugin's instance id, so the
+    // correct browser_plugin will know to ignore the event.
+    resent_gesture_event.resendingPluginId = browser_plugin_instance_id_;
+    host->ForwardGestureEvent(resent_gesture_event);
+  } else if (event.type == blink::WebInputEvent::MouseWheel) {
+    blink::WebMouseWheelEvent resent_wheel_event;
+    memcpy(&resent_wheel_event, &event, sizeof(blink::WebMouseWheelEvent));
+    resent_wheel_event.resendingPluginId = browser_plugin_instance_id_;
+    host->ForwardWheelEvent(resent_wheel_event);
+  } else {
+    NOTIMPLEMENTED();
+  }
+
+}
+
 WebContentsImpl* BrowserPluginGuest::GetWebContents() const {
   return static_cast<WebContentsImpl*>(web_contents());
 }