DisplayCompositor should enforce invariant that frame size and device scale factor are fixed

content/browser/renderer_host/delegated_frame_host.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/delegated_frame_host.h"
 
 #include <algorithm>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 497 matching lines @@
                                          const gfx::Rect& damage_rect) {
   // Frame subscribers are only interested in changes to the target surface, so
   // do not attempt capture if |damage_rect| is empty.  This prevents the draws
   // of parent surfaces from triggering extra frame captures, which can affect
   // smoothness.
   if (id != local_surface_id_ || damage_rect.IsEmpty())
     return;
   AttemptFrameSubscriberCapture(damage_rect);
 }
 
+void DelegatedFrameHost::OnBadFrameReceived() {

[piman, 2017/03/17 20:12:41]

The callback mechanism seems extremely unfortunate:
1- you end up with a deep stack which makes it hard to reason about what you can
and can't do (e.g. can you destroy things?)
2- it makes it difficult to do things in response. For example in
SwapDelegatedFrame we would want to avoid processing any further, if the data is
inconsistent. As is, we would still do a bunch of stuff with that inconsistent
data (everything after SubmitCompositorFrame, including SetShowPrimarySurface,
updating current_surface_size_/current_scale_factor_, calling CheckResizeLocks,
UpdateGutters etc.)
3- the callback may come too late. We may have done things (everything before
SubmitCompositorFrame) that we may want to undo, or something. It's not very
robust to refactoring

How about instead a bool Surface::CheckConsistentFrame(const CompositorFrame&) -
that can be forwarded through the call chain
(CompositorFrameSinkSupport->SurfaceFactory->Surface) and also DCHECK'ed in
Surface::QueueFrame? We could call that one early and just early out the
SwapDelegatedFrame (with or without a ReceivedBadMessage).

+  client_->ReceivedBadMessage(
+      bad_message::BadMessageReason::DFH_BAD_EMBEDDER_MESSAGE);
+}
+
 void DelegatedFrameHost::OnBeginFrame(const cc::BeginFrameArgs& args) {
   begin_frame_source_->OnBeginFrame(args);
 }
 
 void DelegatedFrameHost::EvictDelegatedFrame() {
   if (!has_frame_)
     return;
   client_->DelegatedFrameHostGetLayer()->SetShowSolidColorContent();
   support_->EvictFrame();
   has_frame_ = false;
@@ skipping 321 matching lines @@
 
 void DelegatedFrameHost::ResetCompositorFrameSinkSupport() {
   if (!support_)
     return;
   if (compositor_)
     compositor_->RemoveFrameSink(frame_sink_id_);
   support_.reset();
 }
 
 }  // namespace content