Assert the location is correct when processing a tap request.

content/renderer/gpu/gpu_benchmarking_extension.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/gpu/gpu_benchmarking_extension.h"
 
 #include <stddef.h>
 
 #include <string>
 #include <utility>
@@ skipping 956 matching lines @@
   int gesture_source_type = SyntheticGestureParams::DEFAULT_INPUT;
 
   if (!GetArg(args, &position_x) ||
       !GetArg(args, &position_y) ||
       !GetOptionalArg(args, &callback) ||
       !GetOptionalArg(args, &duration_ms) ||
       !GetOptionalArg(args, &gesture_source_type)) {
     return false;
   }
 
+  // Convert coordinates from CSS pixels to density independent pixels (DIPs).
+  float page_scale_factor = context.web_view()->PageScaleFactor();
+  gfx::Rect rect = context.render_view_impl()->GetWidget()->ViewRect();
+  rect -= rect.OffsetFromOrigin();
+  if (!rect.Contains(position_x * page_scale_factor,
+                     position_y * page_scale_factor)) {
+    args->ThrowError();
+    return false;
+  }
+
   std::unique_ptr<SyntheticTapGestureParams> gesture_params(
       new SyntheticTapGestureParams);
 
-  // Convert coordinates from CSS pixels to density independent pixels (DIPs).
-  float page_scale_factor = context.web_view()->PageScaleFactor();
-
   gesture_params->position.SetPoint(position_x * page_scale_factor,
                                     position_y * page_scale_factor);
   gesture_params->duration_ms = duration_ms;
 
   if (gesture_source_type < 0 ||
       gesture_source_type > SyntheticGestureParams::GESTURE_SOURCE_TYPE_MAX) {
     return false;
   }
   gesture_params->gesture_source_type =
       static_cast<SyntheticGestureParams::GestureSourceType>(
@@ skipping 137 matching lines @@
           &gpu_driver_bug_workarounds))) {
     return;
   }
 
   v8::Local<v8::Value> result;
   if (gin::TryConvertToV8(args->isolate(), gpu_driver_bug_workarounds, &result))
     args->Return(result);
 }
 
 }  // namespace content