Don't send PP_Vars/V8 values with cycles across PostMessage

ppapi/proxy/ppb_instance_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppb_instance_proxy.h"
 
 #include "base/memory/ref_counted.h"
 #include "build/build_config.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/pp_time.h"
@@ skipping 38 matching lines @@
 using ppapi::thunk::EnterResourceNoLock;
 using ppapi::thunk::PPB_Graphics2D_API;
 using ppapi::thunk::PPB_Graphics3D_API;
 using ppapi::thunk::PPB_Instance_API;
 
 namespace ppapi {
 namespace proxy {
 
 namespace {
 
+const char kSerializationError[] = "Failed to convert a PostMessage "
+    "argument from a PP_Var to a Javascript value. It may have cycles or be of "
+    "an unsupported type.";
+
 InterfaceProxy* CreateInstanceProxy(Dispatcher* dispatcher) {
   return new PPB_Instance_Proxy(dispatcher);
 }
 
 void RequestSurroundingText(PP_Instance instance) {
   PluginDispatcher* dispatcher = PluginDispatcher::GetForInstance(instance);
   if (!dispatcher)
     return;  // Instance has gone away while message was pending.
 
   InstanceData* data = dispatcher->GetInstanceData(instance);
@@ skipping 857 matching lines @@
                                                    uint32_t event_classes) {
   EnterInstanceNoLock enter(instance);
   if (enter.succeeded())
     enter.functions()->ClearInputEventRequest(instance, event_classes);
 }
 
 void PPB_Instance_Proxy::OnHostMsgPostMessage(
     PP_Instance instance,
     SerializedVarReceiveInput message) {
   EnterInstanceNoLock enter(instance);
+  if (!message.is_valid_var()) {
+    PpapiGlobals::Get()->LogWithSource(
+        instance, PP_LOGLEVEL_ERROR, std::string(), kSerializationError);
+    return;
+  }
+
   if (enter.succeeded())
     enter.functions()->PostMessage(instance,
                                    message.GetForInstance(dispatcher(),
                                                           instance));
 }
 
 void PPB_Instance_Proxy::OnHostMsgLockMouse(PP_Instance instance) {
   // Need to be careful to always issue the callback.
   pp::CompletionCallback cb = callback_factory_.NewCallback(
       &PPB_Instance_Proxy::MouseLockCompleteInHost, instance);
@@ skipping 308 matching lines @@
     PP_Instance instance) {
   InstanceData* data = static_cast<PluginDispatcher*>(dispatcher())->
       GetInstanceData(instance);
   if (!data)
     return;  // Instance was probably deleted.
   data->should_do_request_surrounding_text = false;
 }
 
 }  // namespace proxy
 }  // namespace ppapi