Validate in-process plugin instance messages.

content/browser/renderer_host/pepper/pepper_renderer_connection.cc

Index: content/browser/renderer_host/pepper/pepper_renderer_connection.cc
diff --git a/content/browser/renderer_host/pepper/pepper_renderer_connection.cc b/content/browser/renderer_host/pepper/pepper_renderer_connection.cc
index d62fe9c9a64525c05f6afb48bb8872db405944b2..be3dccde25a3fd992f9af90af0e7757401e06409 100644
--- a/content/browser/renderer_host/pepper/pepper_renderer_connection.cc
+++ b/content/browser/renderer_host/pepper/pepper_renderer_connection.cc
@@ -232,12 +232,16 @@ void PepperRendererConnection::OnMsgDidCreateInProcessInstance(
     PP_Instance instance,
     const PepperRendererInstanceData& instance_data) {
   PepperRendererInstanceData data = instance_data;
+  // It's important that we supply the render process ID ourselves since the
+  // message may be coming from a compromised renderer.
   data.render_process_id = render_process_id_;
+  // 'instance' is possibly invalid. The host must be careful not to trust it.
   in_process_host_->AddInstance(instance, data);
 }
 
 void PepperRendererConnection::OnMsgDidDeleteInProcessInstance(
     PP_Instance instance) {
+  // 'instance' is possibly invalid. The host must be careful not to trust it.
   in_process_host_->DeleteInstance(instance);
 }