Ensure we aren't using stale invalidation rects for windowless plugins

Fixes two cases where message delays can cause the plugin painting system to use invalidation rects that are larger than the plugin is by the time they are handled.

BUG=35328
TEST=See bug.

Review URL: http://codereview.chromium.org/593063

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@38845 0039d316-1c4b-4281-b951-d872f2087c98

2 files changed, 17 insertions, 6 deletions

diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index f4063e4..6747ef0 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -959,9 +959,14 @@ void WebPluginDelegateProxy::OnInvalidateRect(const gfx::Rect& rect) {
   if (!plugin_)
     return;
 
+  // Clip the invalidation rect to the plugin bounds; the plugin may have been
+  // resized since the invalidate message was sent.
+  const gfx::Rect clipped_rect(rect.Intersect(
+      gfx::Rect(0, 0, plugin_rect_.width(), plugin_rect_.height())));
+
   invalidate_pending_ = true;
-  CopyFromTransportToBacking(rect);
-  plugin_->InvalidateRect(rect);
+  CopyFromTransportToBacking(clipped_rect);
+  plugin_->InvalidateRect(clipped_rect);
 }
 
 void WebPluginDelegateProxy::OnGetWindowScriptNPObject(
diff --git a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
index 4b5c093..fa89506 100644
--- a/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
+++ b/webkit/glue/plugins/webplugin_delegate_impl_mac.mm
@@ -368,6 +368,12 @@ void WebPluginDelegateImpl::WindowlessPaint(gfx::NativeDrawingContext context,
   static StatsRate plugin_paint("Plugin.Paint");
   StatsScope<StatsRate> scope(plugin_paint);
 
+  // Plugin invalidates trigger asynchronous paints with the original
+  // invalidation rect; the plugin may be resized before the paint is handled,
+  // so we need to ensure that the damage rect is still sane.
+  const gfx::Rect paint_rect(damage_rect.Intersect(
+      gfx::Rect(0, 0, window_rect_.width(), window_rect_.height())));
+
   ScopedActiveDelegate active_delegate(this);
 
   switch (instance()->drawing_model()) {
@@ -409,10 +415,10 @@ void WebPluginDelegateImpl::WindowlessPaint(gfx::NativeDrawingContext context,
           memset(&paint_event, 0, sizeof(NPCocoaEvent));
           paint_event.type = NPCocoaEventDrawRect;
           paint_event.data.draw.context = context;
-          paint_event.data.draw.x = damage_rect.x();
-          paint_event.data.draw.y = damage_rect.y();
-          paint_event.data.draw.width = damage_rect.width();
-          paint_event.data.draw.height = damage_rect.height();
+          paint_event.data.draw.x = paint_rect.x();
+          paint_event.data.draw.y = paint_rect.y();
+          paint_event.data.draw.width = paint_rect.width();
+          paint_event.data.draw.height = paint_rect.height();
           instance()->NPP_HandleEvent(reinterpret_cast<NPEvent*>(&paint_event));
           break;
         }