Don't send WebInputEvents from the renderer to the browser....

chrome/browser/renderer_host/render_widget_host.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/renderer_host/render_widget_host.h"
 
 #include "base/gfx/native_widget_types.h"
+#include "base/histogram.h"
 #include "base/message_loop.h"
 #include "base/keyboard_codes.h"
 #include "chrome/browser/renderer_host/backing_store.h"
 #include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_widget_helper.h"
 #include "chrome/browser/renderer_host/render_widget_host_view.h"
 #include "chrome/common/notification_service.h"
 #include "chrome/common/render_messages.h"
 #include "chrome/views/view.h"
 #include "webkit/glue/webcursor.h"
@@ skipping 280 matching lines @@
   }
 
   ForwardInputEvent(key_event, sizeof(WebKeyboardEvent));
 }
 
 void RenderWidgetHost::ForwardInputEvent(const WebInputEvent& input_event,
                                          int event_size) {
   if (!process_->channel())
     return;
 
+  if (input_event.type == WebInputEvent::KEY_DOWN ||

[darin (slow to review), 2009/02/27 00:15:56]

i think we may also need RAW_KEY_DOWN here, right?

[Avi (use Gerrit), 2009/02/27 15:12:47]

RAW_KEY_DOWN does not yet exist. It will once I nail my final issues and
recommit my patch.

+      input_event.type == WebInputEvent::KEY_UP ||
+      input_event.type == WebInputEvent::CHAR) {
+    // Put all WebKeyboardEvent objects in a queue since we can't trust the
+    // renderer and we need to give something to the UnhandledInputEvent
+    // handler.
+    key_queue_.push(static_cast<const WebKeyboardEvent&>(input_event));
+    HISTOGRAM_COUNTS_100("Renderer.KeyboardQueueSize", key_queue_.size());
+  }
+
   IPC::Message* message = new ViewMsg_HandleInputEvent(routing_id_);
   message->WriteData(
       reinterpret_cast<const char*>(&input_event), event_size);
   input_event_start_time_ = TimeTicks::Now();
   Send(message);
 
   // Any input event cancels a pending mouse move event.
   next_mouse_move_.reset();
 
   StartHangMonitorTimeout(TimeDelta::FromMilliseconds(kHungRendererDelayMs));
@@ skipping 229 matching lines @@
   if (type == WebInputEvent::MOUSE_MOVE) {
     mouse_move_pending_ = false;
 
     // now, we can send the next mouse move event
     if (next_mouse_move_.get()) {
       DCHECK(next_mouse_move_->type == WebInputEvent::MOUSE_MOVE);
       ForwardMouseEvent(*next_mouse_move_);
     }
   }
 
-  const char* data = NULL;
-  int length = 0;
-  if (message.ReadData(&iter, &data, &length)) {
-    const WebInputEvent* input_event =
-        reinterpret_cast<const WebInputEvent*>(data);
-    UnhandledInputEvent(*input_event);
+  if (type == WebInputEvent::KEY_DOWN ||
+      type == WebInputEvent::KEY_UP ||
+      type == WebInputEvent::CHAR) {
+    if (key_queue_.size() == 0) {
+      LOG(ERROR) << "Got a KeyEvent back from the renderer but we "
+                 << "don't seem to have sent it to the renderer!";
+    } else if (key_queue_.front().type != type) {
+      LOG(ERROR) << "We seem to have a different key type sent from "
+                 << "the renderer. Ignoring event.";
+    } else {
+      bool processed = false;
+      r = message.ReadBool(&iter, &processed);
+      DCHECK(r);
+
+      if (!processed) {
+        UnhandledKeyboardEvent(key_queue_.front());
+      }
+
+      key_queue_.pop();
+    }
   }
 }
 
 void RenderWidgetHost::OnMsgFocus() {
   // Only the user can focus a RenderWidgetHost.
   NOTREACHED();
 }
 
 void RenderWidgetHost::OnMsgBlur() {
   if (view_) {
@@ skipping 55 matching lines @@
 
   // TODO(darin): do we need to do something else if our backing store is not
   // the same size as the advertised view?  maybe we just assume there is a
   // full paint on its way?
   BackingStore* backing_store = BackingStoreManager::Lookup(this);
   if (!backing_store || (backing_store->size() != view_size))
     return;
   backing_store->ScrollRect(process_->process().handle(), bitmap, bitmap_rect,
                             dx, dy, clip_rect, view_size);
 }