DisplayCompositor should enforce invariant that frame size and device scale factor are fixed

content/browser/renderer_host/delegated_frame_host.cc

Index: content/browser/renderer_host/delegated_frame_host.cc
diff --git a/content/browser/renderer_host/delegated_frame_host.cc b/content/browser/renderer_host/delegated_frame_host.cc
index 085fd44c7b5ec52c6b00654e12193380e92a48cc..afa6597be3fe3ae5c853ba19c75874caf0d3a86b 100644
--- a/content/browser/renderer_host/delegated_frame_host.cc
+++ b/content/browser/renderer_host/delegated_frame_host.cc
@@ -515,6 +515,11 @@ void DelegatedFrameHost::WillDrawSurface(const cc::LocalSurfaceId& id,
   AttemptFrameSubscriberCapture(damage_rect);
 }
 
+void DelegatedFrameHost::OnBadFrameReceived() {

[piman, 2017/03/17 20:12:41]

The callback mechanism seems extremely unfortunate:
1- you end up with a deep stack which makes it hard to reason about what you can
and can't do (e.g. can you destroy things?)
2- it makes it difficult to do things in response. For example in
SwapDelegatedFrame we would want to avoid processing any further, if the data is
inconsistent. As is, we would still do a bunch of stuff with that inconsistent
data (everything after SubmitCompositorFrame, including SetShowPrimarySurface,
updating current_surface_size_/current_scale_factor_, calling CheckResizeLocks,
UpdateGutters etc.)
3- the callback may come too late. We may have done things (everything before
SubmitCompositorFrame) that we may want to undo, or something. It's not very
robust to refactoring

How about instead a bool Surface::CheckConsistentFrame(const CompositorFrame&) -
that can be forwarded through the call chain
(CompositorFrameSinkSupport->SurfaceFactory->Surface) and also DCHECK'ed in
Surface::QueueFrame? We could call that one early and just early out the
SwapDelegatedFrame (with or without a ReceivedBadMessage).

+  client_->ReceivedBadMessage(
+      bad_message::BadMessageReason::DFH_BAD_EMBEDDER_MESSAGE);
+}
+
 void DelegatedFrameHost::OnBeginFrame(const cc::BeginFrameArgs& args) {
   begin_frame_source_->OnBeginFrame(args);
 }