Do not try to use an HTML embed instead of a Flash one inside a PluginDocument.

third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006, 2008, 2009, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 129 matching lines @@
 
     // FIXME: These should be joined into a PluginParameters class.
     Vector<String> paramNames;
     Vector<String> paramValues;
     parametersForPlugin(paramNames, paramValues);
 
     // FIXME: Can we not have layoutObject here now that beforeload events are gone?
     if (!layoutObject())
         return;
 
-    // Overwrites the URL and MIME type of a Flash embed to use an
-    // HTML5 embed when possible.
-    KURL overridenUrl = document().frame()->loader().client()->overrideFlashEmbedWithHTML(document().completeURL(m_url));
-    if (!overridenUrl.isEmpty()) {
-        m_url = overridenUrl.getString();
-        m_serviceType = "text/html";
+    // Overwrites the URL and MIME type of a Flash embed to use an HTML5 embed

[pdr., 2016/08/11 23:21:53]

I see on the bug that this will be very difficult to test in the public repo due
to the dependency on flash. In lieu of a test, WDYT of some asserts in this
area? Possibly turn the ASSERT into a CHECK in PluginDocument::pluginWidget?

[mlamouri (slow - plz ping), 2016/08/12 10:27:32]

I've changed the ASSERT() to a CHECK().

FWIW, a repro was added to the fuzzer so the fuzzer will keep the regression
test around. IMO, this is the best way to test the bug.

+    // when outside of a PluginDocument.
+    if (!document().isPluginDocument()) {

[pdr., 2016/08/11 23:21:53]

Instead of a blacklist, can this be a whitelist? I.e., isHTMLDocument()

[mlamouri (slow - plz ping), 2016/08/12 10:27:32]

The issue is really that the PluginDocument is making assumptions it shouldn't
make. I'm not a big fan of adding checks that would be hard to understand in the
future. Also, ideally, we should find a way for the PluginDocument issue to be
fixed.

+        KURL overridenUrl = document().frame()->loader().client()->overrideFlashEmbedWithHTML(document().completeURL(m_url));
+        if (!overridenUrl.isEmpty()) {
+            m_url = overridenUrl.getString();
+            m_serviceType = "text/html";
+        }
     }
 
     requestObject(m_url, m_serviceType, paramNames, paramValues);
 }
 
 bool HTMLEmbedElement::layoutObjectIsNeeded(const ComputedStyle& style)
 {
     if (isImageType())
         return HTMLPlugInElement::layoutObjectIsNeeded(style);
 
@@ skipping 41 matching lines @@
 {
     // http://www.whatwg.org/specs/web-apps/current-work/#exposed
     for (HTMLObjectElement* object = Traversal<HTMLObjectElement>::firstAncestor(*this); object; object = Traversal<HTMLObjectElement>::firstAncestor(*object)) {
         if (object->isExposed())
             return false;
     }
     return true;
 }
 
 } // namespace blink