Added SkImageFilter serialization

content/common/cc_messages.cc

Index: content/common/cc_messages.cc
diff --git a/content/common/cc_messages.cc b/content/common/cc_messages.cc
index 9065a946ad3bc5ff857e30610170e469a4998575..a122ed80095256332555d57786aeba9377ea42ec 100644
--- a/content/common/cc_messages.cc
+++ b/content/common/cc_messages.cc
@@ -4,9 +4,13 @@
 
 #include "content/common/cc_messages.h"
 
+#include "base/command_line.h"
 #include "cc/output/compositor_frame.h"
 #include "cc/output/filter_operations.h"
 #include "content/public/common/common_param_traits.h"
+#include "content/public/common/content_switches.h"
+#include "third_party/skia/include/core/SkData.h"
+#include "third_party/skia/include/core/SkFlattenableSerialization.h"
 #include "ui/gfx/transform.h"
 
 namespace IPC {
@@ -185,6 +189,41 @@ void ParamTraits<cc::FilterOperations>::Log(
   l->append(")");
 }
 
+void ParamTraits<skia::RefPtr<SkImageFilter> >::Write(
+    Message* m, const param_type& p) {
+  SkImageFilter* filter = p.get();
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  if (filter && command_line.HasSwitch(switches::kAllowFiltersOverIPC)) {
+    skia::RefPtr<SkData> data = skia::AdoptRef(SkSerializeFlattenable(filter));
+    m->WriteData(static_cast<const char*>(data->data()), data->size());
+  } else {
+    m->WriteData(0, 0);
+  }
+}
+
+bool ParamTraits<skia::RefPtr<SkImageFilter> >::Read(
+    const Message* m, PickleIterator* iter, param_type* r) {
+  const char* data = 0;
+  int length = 0;
+  if (!m->ReadData(iter, &data, &length))
+    return false;
+  const CommandLine& command_line = *CommandLine::ForCurrentProcess();
+  if ((length > 0) && command_line.HasSwitch(switches::kAllowFiltersOverIPC)) {
+    SkFlattenable* flattenable = SkDeserializeFlattenable(data, length);
+    *r = skia::AdoptRef(static_cast<SkImageFilter*>(flattenable));

[piman, 2013/08/09 17:38:24]

Even after we make the deserialization safe in Skia terms, we need a way here to
verify that the deserialized object is indeed a SkImageFilter.
Otherwise a compromized renderer could serialize anything (e.g. a SkBitmap or
whatever) and cause type confusion in the browser

+  } else {
+    r->clear();
+  }
+  return true;
+}
+
+void ParamTraits<skia::RefPtr<SkImageFilter> >::Log(
+    const param_type& p, std::string* l) {
+  l->append("(");
+  LogParam(p.get() ? p->countInputs() : 0, l);
+  l->append(")");
+}
+
 void ParamTraits<gfx::Transform>::Write(
     Message* m, const param_type& p) {
   WriteParam(m, p.matrix().getDouble(0, 0));