Do not try to use an HTML embed instead of a Flash one inside a PluginDocument.

third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp

Index: third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
diff --git a/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp b/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
index b10434d1aa7a17569872bad6a5b4a4a088d73dd5..d32ac2788fd4b4ed8a80d47ab16b983bf7a82bad 100644
--- a/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLEmbedElement.cpp
@@ -147,12 +147,14 @@ void HTMLEmbedElement::updateWidgetInternal()
     if (!layoutObject())
         return;
 
-    // Overwrites the URL and MIME type of a Flash embed to use an
-    // HTML5 embed when possible.
-    KURL overridenUrl = document().frame()->loader().client()->overrideFlashEmbedWithHTML(document().completeURL(m_url));
-    if (!overridenUrl.isEmpty()) {
-        m_url = overridenUrl.getString();
-        m_serviceType = "text/html";
+    // Overwrites the URL and MIME type of a Flash embed to use an HTML5 embed

[pdr., 2016/08/11 23:21:53]

I see on the bug that this will be very difficult to test in the public repo due
to the dependency on flash. In lieu of a test, WDYT of some asserts in this
area? Possibly turn the ASSERT into a CHECK in PluginDocument::pluginWidget?

[mlamouri (slow - plz ping), 2016/08/12 10:27:32]

I've changed the ASSERT() to a CHECK().

FWIW, a repro was added to the fuzzer so the fuzzer will keep the regression
test around. IMO, this is the best way to test the bug.

+    // when outside of a PluginDocument.
+    if (!document().isPluginDocument()) {

[pdr., 2016/08/11 23:21:53]

Instead of a blacklist, can this be a whitelist? I.e., isHTMLDocument()

[mlamouri (slow - plz ping), 2016/08/12 10:27:32]

The issue is really that the PluginDocument is making assumptions it shouldn't
make. I'm not a big fan of adding checks that would be hard to understand in the
future. Also, ideally, we should find a way for the PluginDocument issue to be
fixed.

+        KURL overridenUrl = document().frame()->loader().client()->overrideFlashEmbedWithHTML(document().completeURL(m_url));
+        if (!overridenUrl.isEmpty()) {
+            m_url = overridenUrl.getString();
+            m_serviceType = "text/html";
+        }
     }
 
     requestObject(m_url, m_serviceType, paramNames, paramValues);