Pepper Flash Mac: Fix crash when playing video on MB retina

Pepper Flash Mac: Fix crash when playing video on MB retina

When playing video on Mac Book retina devices Chrome would crash.

The problem was that we were using the page scale factor when drawing bitmaps from the plugin. Thus when drawing the bitmap we would dereference memory past the end of the bitmap buffer and crash.

To fix this we now pass the plugin's scale factor instead of the page's scale factor.

BUG=141541
TEST=Note, this crash only happens if accelerated compositing is disabled. This is most common on MB retina devices running 10.7 since the device is on the GPU black list.

To test this I ran Chrome on a Mac Book retina on 10.8 with --disable-accelerated-compositing. I verified that without this patch Chrome crashes and with this patch the video plays fine. Also tested that everything works correctly on an external monitor with a 1x scale factor.

Also, to reproduce this crash you also need this patch:
https://chromiumcodereview.appspot.com/10879050
That patch got reverted due to this crash. Once the fix is checked in I'll reland that patch.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=154593

[Nico, 2012-08-31 04:40:23]

test?

[sail, 2012-08-31 18:20:17]

On 2012/08/31 04:40:23, Nico wrote:
> test?

Added a test to verify that invalid shared memory sizes are rejected.

[Nico, 2012-08-31 19:46:06]

Thanks. I think this lgtm, but the question below makes me doubt I understand
the patch correctly :-P

https://chromiumcodereview.appspot.com/10905036/diff/1026/content/browser/ren...
File content/browser/renderer_host/render_widget_host_impl.cc (right):

https://chromiumcodereview.appspot.com/10905036/diff/1026/content/browser/ren...
content/browser/renderer_host/render_widget_host_impl.cc:1406: if (dib->size() <
size) {
How was this not broken previously?

[sail, 2012-08-31 19:53:52]

https://chromiumcodereview.appspot.com/10905036/diff/1026/content/browser/ren...
File content/browser/renderer_host/render_widget_host_impl.cc (right):

https://chromiumcodereview.appspot.com/10905036/diff/1026/content/browser/ren...
content/browser/renderer_host/render_widget_host_impl.cc:1406: if (dib->size() <
size) {
On 2012/08/31 19:46:07, Nico wrote:
> How was this not broken previously?

This only breaks when:
  1. The plugin scale factor is different from the page scale factor
  2. and accelerated compositing is disabled.

Even then we still don't hit this code patch because of r139366. Due to that
change GetTransportDIB() returns NULL and this code is never run.

[Nico, 2012-08-31 19:54:25]

cool, lgtm

[sail, 2012-08-31 20:00:58]

jamesr: contents/renderer/* OWNERS review
brettw: webkit/plugins/ppapi/* OWNERS review

[jamesr, 2012-08-31 20:22:56]

content/renderer/ and webkit/ lgtm

[brettw, 2012-08-31 21:04:45]

webkit/ LGTM

[Scott Hess - ex-Googler, 2012-08-31 21:49:50]

lgtm - thanks for figuring this all out!

[commit-bot: I haz the power, 2012-09-01 01:20:16]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/sail@chromium.org/10905036/6004

[commit-bot: I haz the power, 2012-09-01 03:37:22]

Change committed as 154593