Reject CompositorFrames with no render passes when deserializing

content/common/android/sync_compositor_messages.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include "base/memory/shared_memory_handle.h"
 #include "base/optional.h"
 #include "cc/output/begin_frame_args.h"
 #include "cc/output/compositor_frame.h"
@@ skipping 123 matching lines @@
                            uint32_t /* compositor_frame_sink_id */,
                            base::Optional<cc::CompositorFrame>);
 
 IPC_SYNC_MESSAGE_ROUTED1_2(SyncCompositorMsg_SetSharedMemory,
                            content::SyncCompositorSetSharedMemoryParams,
                            bool /* success */,
                            content::SyncCompositorCommonRendererParams);
 
 IPC_MESSAGE_ROUTED0(SyncCompositorMsg_ZeroSharedMemory);
 
-IPC_SYNC_MESSAGE_ROUTED1_3(SyncCompositorMsg_DemandDrawSw,
+IPC_SYNC_MESSAGE_ROUTED1_2(SyncCompositorMsg_DemandDrawSw,
                            content::SyncCompositorDemandDrawSwParams,
-                           bool /* result */,
                            content::SyncCompositorCommonRendererParams,
-                           cc::CompositorFrame)
+                           base::Optional<cc::CompositorFrameMetadata>)
 
 IPC_SYNC_MESSAGE_ROUTED2_1(SyncCompositorMsg_ZoomBy,
                            float /* delta */,
                            gfx::Point /* anchor */,
                            content::SyncCompositorCommonRendererParams)
 
 IPC_MESSAGE_ROUTED1(SyncCompositorMsg_SetMemoryPolicy,
                     uint32_t /* bytes_limit */);
 
 IPC_MESSAGE_ROUTED2(SyncCompositorMsg_ReclaimResources,
                     uint32_t /* compositor_frame_sink_id */,
                     cc::ReturnedResourceArray /* resources */);
 
 IPC_MESSAGE_ROUTED1(SyncCompositorMsg_SetScroll, gfx::ScrollOffset);
 
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
 IPC_MESSAGE_ROUTED0(SyncCompositorHostMsg_CompositorFrameSinkCreated);
 
 IPC_MESSAGE_ROUTED1(SyncCompositorHostMsg_UpdateState,
                     content::SyncCompositorCommonRendererParams)
 
 IPC_MESSAGE_ROUTED2(SyncCompositorHostMsg_ReturnFrame,
                     uint32_t /* compositor_frame_sink_id */,
                     base::Optional<cc::CompositorFrame>);