Create child window in GPU process for DirectComposition

content/browser/gpu/gpu_process_host.cc

Index: content/browser/gpu/gpu_process_host.cc
diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index dfe06a8f232c6bf00720d4b6e17c8203bb341c40..f4914862ad80174da849b090eba8cbc120b704dd 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc
@@ -634,6 +634,10 @@ bool GpuProcessHost::OnMessageReceived(const IPC::Message& message) {
                         OnDestroyChannel)
     IPC_MESSAGE_HANDLER(GpuHostMsg_CacheShader,
                         OnCacheShader)
+#if defined(OS_WIN)
+    IPC_MESSAGE_HANDLER(GpuHostMsg_AcceleratedSurfaceCreatedChildWindow,
+                        OnAcceleratedSurfaceCreatedChildWindow)
+#endif
 
     IPC_MESSAGE_UNHANDLED(RouteOnUIThread(message))
   IPC_END_MESSAGE_MAP()
@@ -641,6 +645,31 @@ bool GpuProcessHost::OnMessageReceived(const IPC::Message& message) {
   return true;
 }
 
+#if defined(OS_WIN)
+void GpuProcessHost::OnAcceleratedSurfaceCreatedChildWindow(
+    const gfx::PluginWindowHandle& parent_handle,
+    const gfx::PluginWindowHandle& window_handle) {
+  {
+    DWORD process_id = 0;
+    DWORD thread_id = GetWindowThreadProcessId(parent_handle, &process_id);
+
+    if (!thread_id || process_id != ::GetCurrentProcessId())
+      return;

[Will Harris, 2016/01/06 18:23:32]

could consider calling bad_message::ReceivedBadMessage here, this shouldn't
happen except if someone is trying to fuzz or break ipc.

[jschuh, 2016/01/07 01:41:11]

Yep. This is bad so kill the sender.

+  }
+  {
+    DWORD process_id = 0;
+    DWORD thread_id = GetWindowThreadProcessId(window_handle, &process_id);
+
+    DCHECK(process_);
+
+    if (!thread_id || process_id != process_->GetProcess().Pid())
+      return;
+  }
+
+  ::SetParent(window_handle, parent_handle);
+}
+#endif
+
 void GpuProcessHost::OnChannelConnected(int32 peer_pid) {
   TRACE_EVENT0("gpu", "GpuProcessHost::OnChannelConnected");