Allow webview API in an unblessed extension process

content/browser/browser_plugin/browser_plugin_guest_manager.h

Index: content/browser/browser_plugin/browser_plugin_guest_manager.h
diff --git a/content/browser/browser_plugin/browser_plugin_guest_manager.h b/content/browser/browser_plugin/browser_plugin_guest_manager.h
index a657bfa7a6771252eab565ab799b3d4423f240e0..6c00ec5aa692c6e366feb29f44f9058235b958f1 100644
--- a/content/browser/browser_plugin/browser_plugin_guest_manager.h
+++ b/content/browser/browser_plugin/browser_plugin_guest_manager.h
@@ -38,6 +38,9 @@ class WebContents;
 class WebContentsImpl;
 struct NativeWebKeyboardEvent;
 
+// WARNING: BrowserPlugin could be loaded in an unblessed context, thus any new

[Charlie Reis, 2013/09/25 17:25:18]

This part isn't quite right-- BrowserPlugins can't be loaded in unblessed
contexts.  It's the webview API that's available (though I agree we shouldn't
talk about webviews in content/).

Maybe just leave out the first part:
WARNING: All APIs should be guarded with a process ID check like
CanEmbedderAccessInstanceIDMaybeKill, to prevent abuse by normal renderer
processes.

[guohui, 2013/09/25 22:43:51]

Done.

+// APIs must be guarded with process ID check to prevent abuse by normal
+// renderer processes.
 class CONTENT_EXPORT BrowserPluginGuestManager :
     public base::SupportsUserData::Data {
  public: