Ensure that custom cursors set by windowless flash plugins get marshaled correctly back

to the renderer and eventually to the browser. We rely on the HCURSOR getting marshaled
across on windows. However this regressed when code to validate the custom cursor info
was added in the WebCursor deserialization routines.

Fixes bug http://code.google.com/p/chromium/issues/list?cursor=39436

BUG=39436
TEST=Covered by new custom cursor deserialization unit test.

Review URL: http://codereview.chromium.org/5686001

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@68759 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 35 insertions, 23 deletions

diff --git a/webkit/glue/webcursor.cc b/webkit/glue/webcursor.cc
index 8f76ef9..66f9290 100644
--- a/webkit/glue/webcursor.cc
+++ b/webkit/glue/webcursor.cc
@@ -89,26 +89,27 @@ bool WebCursor::Deserialize(const Pickle* pickle, void** iter) {
       size_y > kMaxCursorDimension)
     return false;
 
-  if (type == WebCursorInfo::TypeCustom && (size_x == 0 || size_y == 0))
-    return false;
-
-  // The * 4 is because the expected format is an array of RGBA pixel values.
-  if (size_x * size_y * 4 > data_len)
-    return false;
-
-  type_ = type;
-  hotspot_.set_x(hotspot_x);
-  hotspot_.set_y(hotspot_y);
-  custom_size_.set_width(size_x);
-  custom_size_.set_height(size_y);
-  ClampHotspot();
-
-  custom_data_.clear();
-  if (data_len > 0) {
-    custom_data_.resize(data_len);
-    memcpy(&custom_data_[0], data, data_len);
+  if (type == WebCursorInfo::TypeCustom) {
+    type_ = type;
+    if (size_x > 0 && size_y > 0) {
+      // The * 4 is because the expected format is an array of RGBA pixel
+      // values.
+      if (size_x * size_y * 4 > data_len)
+        return false;
+
+      hotspot_.set_x(hotspot_x);
+      hotspot_.set_y(hotspot_y);
+      custom_size_.set_width(size_x);
+      custom_size_.set_height(size_y);
+      ClampHotspot();
+
+      custom_data_.clear();
+      if (data_len > 0) {
+        custom_data_.resize(data_len);
+        memcpy(&custom_data_[0], data, data_len);
+      }
+    }
   }
-
   return DeserializePlatformData(pickle, iter);
 }
 
diff --git a/webkit/glue/webcursor_unittest.cc b/webkit/glue/webcursor_unittest.cc
index 6e7701d..f449515 100644
--- a/webkit/glue/webcursor_unittest.cc
+++ b/webkit/glue/webcursor_unittest.cc
@@ -15,7 +15,7 @@ TEST(WebCursorTest, CursorSerialization) {
   // This is a valid custom cursor.
   Pickle ok_custom_pickle;
   // Type and hotspots.
-  ok_custom_pickle.WriteInt(0);
+  ok_custom_pickle.WriteInt(WebCursorInfo::TypeCustom);
   ok_custom_pickle.WriteInt(0);
   ok_custom_pickle.WriteInt(0);
   // X & Y
@@ -32,7 +32,7 @@ TEST(WebCursorTest, CursorSerialization) {
   // This custom cursor has not been send with enough data.
   Pickle short_custom_pickle;
   // Type and hotspots.
-  short_custom_pickle.WriteInt(0);
+  short_custom_pickle.WriteInt(WebCursorInfo::TypeCustom);
   short_custom_pickle.WriteInt(0);
   short_custom_pickle.WriteInt(0);
   // X & Y
@@ -49,7 +49,7 @@ TEST(WebCursorTest, CursorSerialization) {
   // This custom cursor has enough data but is too big.
   Pickle large_custom_pickle;
   // Type and hotspots.
-  large_custom_pickle.WriteInt(0);
+  large_custom_pickle.WriteInt(WebCursorInfo::TypeCustom);
   large_custom_pickle.WriteInt(0);
   large_custom_pickle.WriteInt(0);
   // X & Y
@@ -68,7 +68,7 @@ TEST(WebCursorTest, CursorSerialization) {
   // This custom cursor uses negative lengths.
   Pickle neg_custom_pickle;
   // Type and hotspots.
-  neg_custom_pickle.WriteInt(0);
+  neg_custom_pickle.WriteInt(WebCursorInfo::TypeCustom);
   neg_custom_pickle.WriteInt(0);
   neg_custom_pickle.WriteInt(0);
   // X & Y
@@ -81,6 +81,17 @@ TEST(WebCursorTest, CursorSerialization) {
   neg_custom_pickle.WriteUInt32(0);
   iter = NULL;
   EXPECT_FALSE(custom_cursor.Deserialize(&neg_custom_pickle, &iter));
+
+#if defined(OS_WIN)
+  Pickle win32_custom_pickle;
+  WebCursor win32_custom_cursor;
+  win32_custom_cursor.InitFromExternalCursor(
+      reinterpret_cast<HCURSOR>(1000));
+  EXPECT_TRUE(win32_custom_cursor.Serialize(&win32_custom_pickle));
+  iter = NULL;
+  EXPECT_TRUE(custom_cursor.Deserialize(&win32_custom_pickle, &iter));
+  EXPECT_EQ(reinterpret_cast<HCURSOR>(1000), custom_cursor.GetCursor(NULL));
+#endif  // OS_WIN
 }
 
 TEST(WebCursorTest, ClampHotspot) {