Part 3/3 (RWH/IOSurface) of adding with device scale factor to transport surfaces

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 #include <utility>
 
 #include "base/auto_reset.h"
@@ skipping 1629 matching lines @@
 
 void RenderWidgetHostImpl::OnPaintAtSizeAck(int tag, const gfx::Size& size) {
   std::pair<int, gfx::Size> details = std::make_pair(tag, size);
   NotificationService::current()->Notify(
       NOTIFICATION_RENDER_WIDGET_HOST_DID_RECEIVE_PAINT_AT_SIZE_ACK,
       Source<RenderWidgetHost>(this),
       Details<std::pair<int, gfx::Size> >(&details));
 }
 
 void RenderWidgetHostImpl::OnCompositorSurfaceBuffersSwapped(
-      int32 surface_id,
-      uint64 surface_handle,
-      int32 route_id,
-      const gfx::Size& size,
-      int32 gpu_process_host_id) {
+      const ViewHostMsg_CompositorSurfaceBuffersSwapped_Params& params) {
   TRACE_EVENT0("renderer_host",
                "RenderWidgetHostImpl::OnCompositorSurfaceBuffersSwapped");
   if (!view_) {
     AcceleratedSurfaceMsg_BufferPresented_Params ack_params;
     ack_params.sync_point = 0;
-    RenderWidgetHostImpl::AcknowledgeBufferPresent(route_id,
-                                                   gpu_process_host_id,
+    RenderWidgetHostImpl::AcknowledgeBufferPresent(params.route_id,
+                                                   params.gpu_process_host_id,
                                                    ack_params);
     return;
   }
   GpuHostMsg_AcceleratedSurfaceBuffersSwapped_Params gpu_params;
-  gpu_params.surface_id = surface_id;
-  gpu_params.surface_handle = surface_handle;
-  gpu_params.route_id = route_id;
-  gpu_params.size = size;
+  gpu_params.surface_id = params.surface_id;
+  gpu_params.surface_handle = params.surface_handle;
+  gpu_params.route_id = params.route_id;
+  gpu_params.size = params.size;
+  gpu_params.scale_factor = params.scale_factor;

[Chris Evans, 2013/05/22 22:30:30]

This new parameter looks to come from the untrusted renderer. Before landing,
can you make sure nothing dies horribly with weird float values (inf, nan,
negatives, tiny fractions, huge numbers).

[ccameron, 2013/05/23 00:19:59]

We scale gpu_params.size by 1/scale_factor, which can result in messy values.
Those values aren't used to index into arrays, or anything that would obviously
go wrong (they're used as vertex coordinates, so strange values would be
clipped).

I tried inserting some bad values (nan, inf, 0, and -1), and the result was that
the contents area turned a solid color (which is about expected).

   view_->AcceleratedSurfaceBuffersSwapped(gpu_params,
-                                          gpu_process_host_id);
+                                          params.gpu_process_host_id);
 }
 
 bool RenderWidgetHostImpl::OnSwapCompositorFrame(
     const IPC::Message& message) {
   ViewHostMsg_SwapCompositorFrame::Param param;
   if (!ViewHostMsg_SwapCompositorFrame::Read(&message, &param))
     return false;
   scoped_ptr<cc::CompositorFrame> frame(new cc::CompositorFrame);
   param.a.AssignTo(frame.get());
 
@@ skipping 797 matching lines @@
 }
 
 void RenderWidgetHostImpl::DetachDelegate() {
   delegate_ = NULL;
 }
 
 void RenderWidgetHostImpl::FrameSwapped(const cc::LatencyInfo& latency_info) {
 }
 
 }  // namespace content