WebVR: Add sanity checks for decoded pose index values

chrome/browser/android/vr_shell/vr_shell.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_ANDROID_VR_SHELL_VR_SHELL_H_
 #define CHROME_BROWSER_ANDROID_VR_SHELL_VR_SHELL_H_
 
 #include <jni.h>
 
 #include <memory>
@@ skipping 115 matching lines @@
   ~VrShell() override;
   void LoadUIContent();
   void DrawVrShell(const gvr::Mat4f& head_pose, gvr::Frame &frame);
   void DrawUiView(const gvr::Mat4f* head_pose,
                   const std::vector<const ContentRectangle*>& elements,
                   const gvr::Sizei& render_size, int viewport_offset);
   void DrawElements(const gvr::Mat4f& render_matrix,
                     const std::vector<const ContentRectangle*>& elements);
   void DrawCursor(const gvr::Mat4f& render_matrix);
   void DrawWebVr();
+  bool WebVrPoseByteIsValid(int pose_index_byte);
 
   void UpdateController(const gvr::Vec3f& forward_vector);
   void SendEventsToTarget(VrInputManager* input_target,
                           int pixel_x,
                           int pixel_y);
 
   void HandleQueuedTasks();
 
   // content::WebContentsObserver implementation.
   void RenderViewHostChanged(content::RenderViewHost* old_host,
@@ skipping 52 matching lines @@
   int content_tex_height_ = 0;
   gvr::Sizei content_tex_pixels_for_webvr_ = {0, 0};
 
   bool webvr_mode_ = false;
 
   // The pose ring buffer size must be a power of two to avoid glitches when
   // the pose index wraps around. It should be large enough to handle the
   // current backlog of poses which is 2-3 frames.
   static constexpr int kPoseRingBufferSize = 8;
   std::vector<gvr::Mat4f> webvr_head_pose_;
+  std::vector<bool> webvr_head_pose_valid_;
   jint webvr_texture_id_ = 0;
 
   std::unique_ptr<VrController> controller_;
   scoped_refptr<VrInputManager> content_input_manager_;
   scoped_refptr<VrInputManager> ui_input_manager_;
   scoped_refptr<VrMetricsHelper> metrics_helper_;
 
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_task_runner_;
 
   base::WeakPtrFactory<VrShell> weak_ptr_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(VrShell);
 };
 
 bool RegisterVrShell(JNIEnv* env);
 
 }  // namespace vr_shell
 
 #endif  // CHROME_BROWSER_ANDROID_VR_SHELL_VR_SHELL_H_