PPAPI/NaCl: Sanitize CallOnMainThread delay parameter

ppapi/proxy/ppb_core_proxy.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ppapi/proxy/ppb_core_proxy.h"
 
 #include <stdlib.h>  // For malloc
 
 #include "base/bind.h"
 #include "base/debug/trace_event.h"
@@ skipping 36 matching lines @@
   TRACE_EVENT2("ppapi proxy", "CallOnMainThread callback",
                "Func", reinterpret_cast<void*>(callback.func),
                "UserData", callback.user_data);
   CallWhileUnlocked(PP_RunCompletionCallback, &callback, result);
 }
 
 void CallOnMainThread(int delay_in_ms,
                       PP_CompletionCallback callback,
                       int32_t result) {
   DCHECK(callback.func);
+#if defined(OS_NACL)
+  // Some NaCl apps pass a negative delay, so we just sanitize to 0, to run as
+  // soon as possible. MessageLoop checks that the delay is non-negative.
+  if (delay_in_ms < 0)
+    delay_in_ms = 0;
+#endif
   if (!callback.func)
     return;
   PpapiGlobals::Get()->GetMainThreadMessageLoop()->PostDelayedTask(
       FROM_HERE,
       RunWhileLocked(base::Bind(&CallbackWrapper, callback, result)),
       base::TimeDelta::FromMilliseconds(delay_in_ms));
 }
 
 PP_Bool IsMainThread() {
   return PP_FromBool(PpapiGlobals::Get()->
@@ skipping 44 matching lines @@
 void PPB_Core_Proxy::OnMsgAddRefResource(const HostResource& resource) {
   ppb_core_impl_->AddRefResource(resource.host_resource());
 }
 
 void PPB_Core_Proxy::OnMsgReleaseResource(const HostResource& resource) {
   ppb_core_impl_->ReleaseResource(resource.host_resource());
 }
 
 }  // namespace proxy
 }  // namespace ppapi