Revert 129627 - Add a sandbox API for broker handle duplication

content/plugin/webplugin_proxy.cc

Index: content/plugin/webplugin_proxy.cc
===================================================================
--- content/plugin/webplugin_proxy.cc	(revision 129628)
+++ content/plugin/webplugin_proxy.cc	(working copy)
@@ -35,10 +35,6 @@
 #include "ui/base/x/x11_util_internal.h"
 #endif
 
-#if defined(OS_WIN)
-#include "content/common/sandbox_policy.h"
-#endif
-
 using WebKit::WebBindings;
 
 using webkit::npapi::WebPluginResourceClient;
@@ -133,9 +129,10 @@
 #if defined(OS_WIN)
 void WebPluginProxy::SetWindowlessPumpEvent(HANDLE pump_messages_event) {
   HANDLE pump_messages_event_for_renderer = NULL;
-  sandbox::BrokerDuplicateHandle(pump_messages_event, channel_->peer_pid(),
-                                 &pump_messages_event_for_renderer,
-                                 0, DUPLICATE_SAME_ACCESS);
+  DuplicateHandle(GetCurrentProcess(), pump_messages_event,
+                  channel_->renderer_handle(),
+                  &pump_messages_event_for_renderer,
+                  0, FALSE, DUPLICATE_SAME_ACCESS);
   DCHECK(pump_messages_event_for_renderer != NULL);
   Send(new PluginHostMsg_SetWindowlessPumpEvent(
       route_id_, pump_messages_event_for_renderer));
@@ -473,17 +470,25 @@
     const TransportDIB::Handle& dib_handle,
     const gfx::Rect& window_rect,
     scoped_ptr<skia::PlatformCanvas>* canvas_out) {
+  // Create a canvas that will reference the shared bits. We have to handle
+  // errors here since we're mapping a large amount of memory that may not fit
+  // in our address space, or go wrong in some other way.
+  HANDLE section;
+  DuplicateHandle(channel_->renderer_handle(), dib_handle, GetCurrentProcess(),
+                  &section,
+                  STANDARD_RIGHTS_REQUIRED | FILE_MAP_READ | FILE_MAP_WRITE,
+                  FALSE, 0);
   scoped_ptr<skia::PlatformCanvas> canvas(new skia::PlatformCanvas);
   if (!canvas->initialize(
           window_rect.width(),
           window_rect.height(),
           true,
-          dib_handle)) {
+          section)) {
     canvas_out->reset();
   }
   canvas_out->reset(canvas.release());
   // The canvas does not own the section so we need to close it now.
-  CloseHandle(dib_handle);
+  CloseHandle(section);
 }
 
 void WebPluginProxy::SetWindowlessBuffers(