Commit message: None
CVE: CVE-2012-2875
Vulnerability description: Multiple unspecified vulnerabilities in the PDF functionality in Google Chrome before 22.0.1229.79 allow remote attackers to have an unknown impact via a crafted document.

Project: Chrome

void RootWindow::AddRootWindowObserver(RootWindowObserver* observer) {
  observers_.AddObserver(observer);
}

Project: Chrome

bool RootWindow::DispatchMouseEvent(MouseEvent* event) {
  if (mouse_move_hold_count_) {
    if (event->type() == ui::ET_MOUSE_DRAGGED ||
        (event->flags() & ui::EF_IS_SYNTHESIZED)) {
      held_mouse_move_.reset(new MouseEvent(*event, NULL, NULL));
      return true;
    } else {
      DispatchHeldMouseMove();
    }
  }
  return DispatchMouseEventImpl(event);
}

Project: Chrome

bool RootWindow::DispatchMouseEventImpl(MouseEvent* event) {
  if (ui::IsDIPEnabled()) {
    float scale = ui::GetDeviceScaleFactor(layer());
    ui::Transform transform = layer()->transform();
    transform.ConcatScale(scale, scale);
    event->UpdateForRootTransform(transform);
  } else {
    event->UpdateForRootTransform(layer()->transform());
  }
  Window* target =
      mouse_pressed_handler_ ? mouse_pressed_handler_ : capture_window_;
  if (!target)
    target = GetEventHandlerForPoint(event->location());
  return DispatchMouseEventToTarget(event, target);
}

Project: Chrome

bool RootWindow::DispatchScrollEvent(ScrollEvent* event) {
  DispatchHeldMouseMove();
  if (ui::IsDIPEnabled()) {
    float scale = ui::GetDeviceScaleFactor(layer());
    ui::Transform transform = layer()->transform();
    transform.ConcatScale(scale, scale);
    event->UpdateForRootTransform(transform);
  } else {
    event->UpdateForRootTransform(layer()->transform());
  }

  last_mouse_location_ = event->location();
  synthesize_mouse_move_ = false;

  Window* target =
      mouse_pressed_handler_ ? mouse_pressed_handler_ : capture_window_;
  if (!target)
    target = GetEventHandlerForPoint(event->location());

  if (target && target->delegate()) {
    int flags = event->flags();
    gfx::Point location_in_window = event->location();
    Window::ConvertPointToWindow(this, target, &location_in_window);
    if (IsNonClientLocation(target, location_in_window))
      flags |= ui::EF_IS_NON_CLIENT;
    ScrollEvent translated_event(*event, this, target, event->type(), flags);
    return ProcessMouseEvent(target, &translated_event);
  }
  return false;
}

Project: Chrome

bool RootWindow::DispatchTouchEvent(TouchEvent* event) {
  DispatchHeldMouseMove();
  if (ui::IsDIPEnabled()) {
    float scale = ui::GetDeviceScaleFactor(layer());
    ui::Transform transform = layer()->transform();
    transform.ConcatScale(scale, scale);
    event->UpdateForRootTransform(transform);
  } else {
    event->UpdateForRootTransform(layer()->transform());
  }
  bool handled = false;
  ui::TouchStatus status = ui::TOUCH_STATUS_UNKNOWN;
  Window* target = capture_window_;
  if (!target) {
    target = ConsumerToWindow(
        gesture_recognizer_->GetTouchLockedTarget(event));
    if (!target) {
      target = ConsumerToWindow(
          gesture_recognizer_->GetTargetForLocation(event->GetLocation()));
    }
  }

  if (!target && !bounds().Contains(event->location())) {
    target = this;
  } else {
    if (!target) {
      target = GetEventHandlerForPoint(event->location());
      if (!target)
        return false;
    }

    TouchEvent translated_event(*event, this, target);
    status = ProcessTouchEvent(target, &translated_event);
    handled = status != ui::TOUCH_STATUS_UNKNOWN;

    if (status == ui::TOUCH_STATUS_QUEUED ||
        status == ui::TOUCH_STATUS_QUEUED_END)
      gesture_recognizer_->QueueTouchEventForGesture(target, *event);
  }

  scoped_ptr<ui::GestureRecognizer::Gestures> gestures;
  gestures.reset(gesture_recognizer_->ProcessTouchEventForGesture(
      *event, status, target));

  return ProcessGestures(gestures.get()) ? true : handled;
}

Project: Chrome

internal::FocusManager* RootWindow::GetFocusManager() {
  return this;
}

Project: Chrome

gfx::Size RootWindow::GetHostSize() const {
  return host_->GetBounds().size();
}

Project: Chrome

bool RootWindow::IsFocusedWindow(const Window* window) const {
  return focused_window_ == window;
}

Project: Chrome

void RootWindow::OnHostResized(const gfx::Size& size_in_pixel) {
  DispatchHeldMouseMove();
  compositor_->SetScaleAndSize(GetDeviceScaleFactorFromMonitor(this),
                               size_in_pixel);
  gfx::Size old(bounds().size());
  gfx::Rect bounds(ui::ConvertSizeToDIP(layer(), size_in_pixel));
  layer()->transform().TransformRect(&bounds);
  SetBounds(bounds);
  FOR_EACH_OBSERVER(RootWindowObserver, observers_,
                    OnRootWindowResized(this, old));
}

Project: Chrome

void RootWindow::OnLayerAnimationScheduled(
    ui::LayerAnimationSequence* animation) {
}

Project: Chrome

void RootWindow::OnWindowAddedToRootWindow(Window* attached) {
  if (attached->IsVisible() &&
      attached->ContainsPointInRoot(last_mouse_location_))
    PostMouseMoveEventAfterWindowChange();
}

Project: Chrome

void RootWindow::OnWindowTransformed(Window* window, bool contained_mouse) {
  if (contained_mouse ||
      (window->IsVisible() &&
       window->ContainsPointInRoot(last_mouse_location_))) {
    PostMouseMoveEventAfterWindowChange();
  }
}

Project: Chrome

void RootWindow::OnWindowVisibilityChanged(Window* window, bool is_visible) {
  if (!is_visible)
    OnWindowHidden(window, false);

  if (window->ContainsPointInRoot(last_mouse_location_))
    PostMouseMoveEventAfterWindowChange();
}

Project: Chrome

bool RootWindow::ProcessGestures(ui::GestureRecognizer::Gestures* gestures) {
  if (!gestures)
    return false;
  bool handled = false;
  for (unsigned int i = 0; i < gestures->size(); i++) {
    GestureEvent* gesture =
        static_cast<GestureEvent*>(gestures->get().at(i));
    if (DispatchGestureEvent(gesture) != ui::GESTURE_STATUS_UNKNOWN)
      handled = true;
  }
  return handled;
}

Project: Chrome

void RootWindow::ScheduleFullDraw() {
  compositor_->ScheduleFullDraw();
}

Project: Chrome

RootWindow::~RootWindow() {
  if (compositor_lock_) {
    draw_on_compositor_unlock_ = false;
    compositor_lock_->CancelLock();
    DCHECK(!compositor_lock_);
  }
  compositor_->RemoveObserver(this);
  compositor_.reset();

  host_.reset(NULL);

  layer()->GetAnimator()->RemoveObserver(this);
}

Project: Chrome

int CoalescePendingXIMotionEvents(const XEvent* xev, XEvent* last_event) {
  XIDeviceEvent* xievent = static_cast<XIDeviceEvent*>(xev->xcookie.data);
  int num_coalesed = 0;
  Display* display = xev->xany.display;

  while (XPending(display)) {
    XEvent next_event;
    XPeekEvent(display, &next_event);

    if (!XGetEventData(next_event.xgeneric.display, &next_event.xcookie))
      return num_coalesed;

    if (!ui::TouchFactory::GetInstance()->ShouldProcessXI2Event(&next_event)) {
      CheckXEventForConsistency(&next_event);
      XFreeEventData(display, &next_event.xcookie);
      XNextEvent(display, &next_event);
      continue;
    }

    if (next_event.type == GenericEvent &&
        next_event.xgeneric.evtype == XI_Motion &&
        !ui::GetScrollOffsets(&next_event, NULL, NULL)) {
      XIDeviceEvent* next_xievent =
          static_cast<XIDeviceEvent*>(next_event.xcookie.data);
      if (xievent->event == next_xievent->event &&
          xievent->child == next_xievent->child &&
          xievent->buttons.mask_len == next_xievent->buttons.mask_len &&
          (memcmp(xievent->buttons.mask,
                  next_xievent->buttons.mask,
                  xievent->buttons.mask_len) == 0) &&
          xievent->mods.base == next_xievent->mods.base &&
          xievent->mods.latched == next_xievent->mods.latched &&
          xievent->mods.locked == next_xievent->mods.locked &&
          xievent->mods.effective == next_xievent->mods.effective) {
        XFreeEventData(display, &next_event.xcookie);
        if (num_coalesed > 0)
          XFreeEventData(display, &last_event->xcookie);
        XNextEvent(display, last_event);
        XGetEventData(display, &last_event->xcookie);
        CheckXEventForConsistency(last_event);
        ++num_coalesed;
        continue;
      } else {
        XFreeEventData(display, &next_event.xcookie);
      }
    }
    break;
  }
  return num_coalesed;
}

Project: Chrome

RootWindowHostLinux::RootWindowHostLinux(const gfx::Rect& bounds)
    : root_window_(NULL),
      xdisplay_(base::MessagePumpX::GetDefaultXDisplay()),
      xwindow_(0),
      x_root_window_(DefaultRootWindow(xdisplay_)),
      current_cursor_(ui::kCursorNull),
      cursor_shown_(true),
      bounds_(bounds),
      focus_when_shown_(false),
      pointer_barriers_(NULL),
      image_cursors_(new ImageCursors) {
  XSetWindowAttributes swa;
  memset(&swa, 0, sizeof(swa));
  swa.background_pixmap = None;
  xwindow_ = XCreateWindow(
      xdisplay_, x_root_window_,
      bounds.x(), bounds.y(), bounds.width(), bounds.height(),
      0,               // border width
      CopyFromParent,  // depth
      InputOutput,
      CopyFromParent,  // visual
      CWBackPixmap,
      &swa);
  static_cast<DispatcherLinux*>(Env::GetInstance()->GetDispatcher())->
      WindowDispatcherCreated(xwindow_, this);

  prop_.reset(new ui::ViewProp(xwindow_, kRootWindowHostLinuxKey, this));

  long event_mask = ButtonPressMask | ButtonReleaseMask | FocusChangeMask |
                    KeyPressMask | KeyReleaseMask |
                    EnterWindowMask | LeaveWindowMask |
                    ExposureMask | VisibilityChangeMask |
                    StructureNotifyMask | PropertyChangeMask |
                    PointerMotionMask;
  XSelectInput(xdisplay_, xwindow_, event_mask);
  XFlush(xdisplay_);

  if (base::MessagePumpForUI::HasXInput2())
    ui::TouchFactory::GetInstance()->SetupXI2ForXWindow(xwindow_);

  char nodata[] = { 0, 0, 0, 0, 0, 0, 0, 0 };
  XColor black;
  black.red = black.green = black.blue = 0;
  Pixmap blank = XCreateBitmapFromData(xdisplay_, xwindow_,
                                       nodata, 8, 8);
  invisible_cursor_ = XCreatePixmapCursor(xdisplay_, blank, blank,
                                          &black, &black, 0, 0);
  XFreePixmap(xdisplay_, blank);

  if (RootWindow::hide_host_cursor())
    XDefineCursor(xdisplay_, x_root_window_, invisible_cursor_);

  X11AtomCache* cache = X11AtomCache::GetInstance();
  ::Atom protocols[2];
  protocols[0] = cache->GetAtom(ui::ATOM_WM_DELETE_WINDOW);
  protocols[1] = cache->GetAtom(ui::ATOM__NET_WM_PING);
  XSetWMProtocols(xdisplay_, xwindow_, protocols, 2);

  XSetWMProperties(xdisplay_, xwindow_, NULL, NULL, NULL, 0, NULL, NULL, NULL);

  pid_t pid = getpid();
  XChangeProperty(xdisplay_,
                  xwindow_,
                  cache->GetAtom(ui::ATOM__NET_WM_PID),
                  XA_CARDINAL,
                  32,
                  PropModeReplace,
                  reinterpret_cast<unsigned char*>(&pid), 1);

  static int root_window_number = 0;
  std::string name = StringPrintf("aura_root_%d", root_window_number++);
  XStoreName(xdisplay_, xwindow_, name.c_str());
}

Project: Chrome

bool ShouldSendCharEventForKeyboardCode(ui::KeyboardCode keycode) {
  if ((keycode >= ui::VKEY_0 && keycode <= ui::VKEY_9) ||
      (keycode >= ui::VKEY_A && keycode <= ui::VKEY_Z) ||
      (keycode >= ui::VKEY_NUMPAD0 && keycode <= ui::VKEY_NUMPAD9)) {
    return true;
  }

  switch (keycode) {
    case ui::VKEY_RETURN:
    case ui::VKEY_SPACE:
    case ui::VKEY_MULTIPLY:
    case ui::VKEY_ADD:
    case ui::VKEY_SUBTRACT:
    case ui::VKEY_DECIMAL:
    case ui::VKEY_DIVIDE:
    case ui::VKEY_OEM_1:
    case ui::VKEY_OEM_2:
    case ui::VKEY_OEM_3:
    case ui::VKEY_OEM_4:
    case ui::VKEY_OEM_5:
    case ui::VKEY_OEM_6:
    case ui::VKEY_OEM_7:
    case ui::VKEY_OEM_102:
    case ui::VKEY_OEM_PLUS:
    case ui::VKEY_OEM_COMMA:
    case ui::VKEY_OEM_MINUS:
    case ui::VKEY_OEM_PERIOD:
      return true;
    default:
      return false;
  }
}

Project: Chrome

void RootWindowHostLinux::ToggleFullScreen() {
  NOTIMPLEMENTED();
}

Project: Chrome

  ~ImageCursors() {
    std::map<int, Cursor>::const_iterator it;
    for (it = cursors_.begin(); it != cursors_.end(); ++it)
      ui::UnrefCustomXCursor(it->second);
  }