Some security checks around destruction/setting bounds.

mojo/services/public/cpp/view_manager/lib/view_tree_node.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/services/public/cpp/view_manager/view_tree_node.h"
 
 #include "mojo/services/public/cpp/view_manager/lib/view_manager_private.h"
 #include "mojo/services/public/cpp/view_manager/lib/view_manager_synchronizer.h"
 #include "mojo/services/public/cpp/view_manager/lib/view_private.h"
 #include "mojo/services/public/cpp/view_manager/lib/view_tree_node_private.h"
@@ skipping 162 matching lines @@
         *ViewTreeNodePrivate(node_).observers(),
         OnNodeDestroy(node_, ViewTreeNodeObserver::DISPOSITION_CHANGED));
   }
 
  private:
   ViewTreeNode* node_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopedDestructionNotifier);
 };
 
+// Some operations are only permitted in the connection that created the node.
+bool CanMutateNode(ViewManager* manager, ViewTreeNode* node) {

[sky, 2014/05/23 13:16:29]

Maybe this should be named OwnedNode since some mutations are still allowed for
nodes from other connections.

+  return !manager ||
+      ViewManagerPrivate(manager).synchronizer()->OwnsNode(node->id());
+}
+
 }  // namespace
 
 ////////////////////////////////////////////////////////////////////////////////
 // ViewTreeNode, public:
 
 // static
 ViewTreeNode* ViewTreeNode::Create(ViewManager* view_manager) {
   ViewTreeNode* node = new ViewTreeNode(view_manager);
   ViewManagerPrivate(view_manager).AddNode(node->id(), node);
   return node;
 }
 
 void ViewTreeNode::Destroy() {
-  // TODO(beng): only proceed if |manager_| OwnsNode(this).
+  if (!CanMutateNode(manager_, this))
+    return;
+
   if (manager_)
     ViewManagerPrivate(manager_).synchronizer()->DestroyViewTreeNode(id_);
   while (!children_.empty())
     children_.front()->Destroy();
   LocalDestroy();
 }
 
 void ViewTreeNode::SetBounds(const gfx::Rect& bounds) {
-  // TODO(beng): only proceed if |manager_| OwnsNode(this).
+  if (!CanMutateNode(manager_, this))
+    return;
+
   if (manager_)
     ViewManagerPrivate(manager_).synchronizer()->SetBounds(id_, bounds);
   LocalSetBounds(bounds_, bounds);
 }
 
 void ViewTreeNode::AddObserver(ViewTreeNodeObserver* observer) {
   observers_.AddObserver(observer);
 }
 
 void ViewTreeNode::RemoveObserver(ViewTreeNodeObserver* observer) {
   observers_.RemoveObserver(observer);
 }
 
 void ViewTreeNode::AddChild(ViewTreeNode* child) {
+  // TODO(beng): not necessarily valid to all connections, but possibly to the
+  //             embeddee in an embedder-embeddee relationship.
   if (manager_)
     CHECK_EQ(ViewTreeNodePrivate(child).view_manager(), manager_);
   LocalAddChild(child);
   if (manager_)
     ViewManagerPrivate(manager_).synchronizer()->AddChild(child->id(), id_);
 }
 
 void ViewTreeNode::RemoveChild(ViewTreeNode* child) {
+  // TODO(beng): not necessarily valid to all connections, but possibly to the
+  //             embeddee in an embedder-embeddee relationship.
   if (manager_)
     CHECK_EQ(ViewTreeNodePrivate(child).view_manager(), manager_);
   LocalRemoveChild(child);
   if (manager_)
     ViewManagerPrivate(manager_).synchronizer()->RemoveChild(child->id(), id_);
 }
 
 bool ViewTreeNode::Contains(ViewTreeNode* child) const {
   if (manager_)
     CHECK_EQ(ViewTreeNodePrivate(child).view_manager(), manager_);
@@ skipping 11 matching lines @@
   Children::const_iterator it = children_.begin();
   for (; it != children_.end(); ++it) {
     ViewTreeNode* node = (*it)->GetChildById(id);
     if (node)
       return node;
   }
   return NULL;
 }
 
 void ViewTreeNode::SetActiveView(View* view) {
+  // TODO(beng): not necessarily valid to all connections, but possibly to the
+  //             embeddee in an embedder-embeddee relationship.
   if (manager_)
     CHECK_EQ(ViewPrivate(view).view_manager(), manager_);
   LocalSetActiveView(view);
   if (manager_) {
     ViewManagerPrivate(manager_).synchronizer()->SetActiveView(
         id_, active_view_->id());
   }
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ skipping 52 matching lines @@
 void ViewTreeNode::LocalSetBounds(const gfx::Rect& old_bounds,
                                   const gfx::Rect& new_bounds) {
   DCHECK(old_bounds == bounds_);
   ScopedSetBoundsNotifier notifier(this, old_bounds, new_bounds);
   bounds_ = new_bounds;
 }
 
 }  // namespace view_manager
 }  // namespace mojo