Pepper Flash Mac: Fix crash when playing video on MB retina

content/browser/renderer_host/render_widget_host_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 
 #include <math.h>
 #include <utility>
 
 #include "base/auto_reset.h"
@@ skipping 1383 matching lines @@
 
   bool was_async = false;
 
   // If this is a GPU UpdateRect, params.bitmap is invalid and dib will be NULL.
   TransportDIB* dib = process_->GetTransportDIB(params.bitmap);
 
   // If gpu process does painting, scroll_rect and copy_rects are always empty
   // and backing store is never used.
   if (dib) {
     DCHECK(!params.bitmap_rect.IsEmpty());
-    const size_t size = params.bitmap_rect.height() *
-        params.bitmap_rect.width() * 4;
+    gfx::Size pixel_size = params.bitmap_rect.size().Scale(params.scale_factor);
+    const size_t size = pixel_size.height() * pixel_size.width() * 4;
     if (dib->size() < size) {

[Nico, 2012/08/31 19:46:07]

How was this not broken previously?

[sail, 2012/08/31 19:53:52]

This only breaks when:
  1. The plugin scale factor is different from the page scale factor
  2. and accelerated compositing is disabled.

Even then we still don't hit this code patch because of r139366. Due to that
change GetTransportDIB() returns NULL and this code is never run.

       DLOG(WARNING) << "Transport DIB too small for given rectangle";
       RecordAction(UserMetricsAction("BadMessageTerminate_RWH1"));
       GetProcess()->ReceivedBadMessage();
     } else {
       UNSHIPPED_TRACE_EVENT_INSTANT2("test_latency", "UpdateRect",
           "x+y", params.bitmap_rect.x() + params.bitmap_rect.y(),
           "color", 0xffffff & *static_cast<uint32*>(dib->memory()));
       UNSHIPPED_TRACE_EVENT_INSTANT1("test_latency", "UpdateRectWidth",
           "width", params.bitmap_rect.width());
 
@@ skipping 621 matching lines @@
   // indicate that no callback is in progress (i.e. without this line
   // DelayedAutoResized will not get called again).
   new_auto_size_.SetSize(0, 0);
   if (!should_auto_resize_)
     return;
 
   OnRenderAutoResized(new_size);
 }
 
 }  // namespace content