Give QuickTime the plugin stream data in writeable memory as it modifies it.

This broke after switching the fetching of plugin stream data to the plugin process because now the data from ResourceDispatcher is passed directly to the plugin and it's read-only.

BUG=308466
R=ananta@chromium.org

Review URL: https://codereview.chromium.org/141333005

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@245600 0039d316-1c4b-4281-b951-d872f2087c98

content/child/npapi/plugin_url_fetcher.cc

@@ -4,6 +4,7 @@
 
 #include "content/child/npapi/plugin_url_fetcher.h"
 
+#include "base/memory/scoped_ptr.h"
 #include "content/child/child_thread.h"
 #include "content/child/npapi/webplugin.h"
 #include "content/child/npapi/plugin_host.h"
@@ -80,7 +81,8 @@ PluginURLFetcher::PluginURLFetcher(PluginStreamUrl* plugin_stream,
                                    bool is_plugin_src_load,
                                    int origin_pid,
                                    int render_frame_id,
-                                   unsigned long resource_id)
+                                   unsigned long resource_id,
+                                   bool copy_stream_data)
     : plugin_stream_(plugin_stream),
       url_(url),
       first_party_for_cookies_(first_party_for_cookies),
@@ -89,6 +91,7 @@ PluginURLFetcher::PluginURLFetcher(PluginStreamUrl* plugin_stream,
       notify_redirects_(notify_redirects),
       is_plugin_src_load_(is_plugin_src_load),
       resource_id_(resource_id),
+      copy_stream_data_(copy_stream_data),
       data_offset_(0),
       pending_failure_notification_(false) {
   webkit_glue::ResourceLoaderBridge::RequestInfo request_info;
@@ -301,7 +304,17 @@ void PluginURLFetcher::OnReceivedData(const char* data,
   } else {
     int64 offset = data_offset_;
     data_offset_ += data_length;
-    plugin_stream_->DidReceiveData(data, data_length, offset);
+
+    if (copy_stream_data_) {
+      // QuickTime writes to this memory, and since we got it from
+      // ResourceDispatcher it's not mapped for write access in this process.
+      // http://crbug.com/308466.
+      scoped_ptr<char[]> data_copy(new char[data_length]);
+      memcpy(data_copy.get(), data, data_length);
+      plugin_stream_->DidReceiveData(data_copy.get(), data_length, offset);
+    } else {
+      plugin_stream_->DidReceiveData(data, data_length, offset);
+    }
     // DANGER: this instance may be deleted at this point.
   }
 }

content/child/npapi/plugin_url_fetcher.h

@@ -33,7 +33,8 @@ class PluginURLFetcher : public webkit_glue::ResourceLoaderBridge::Peer {
                    bool is_plugin_src_load,
                    int origin_pid,
                    int render_frame_id,
-                   unsigned long resource_id);
+                   unsigned long resource_id,
+                   bool copy_stream_data);
   virtual ~PluginURLFetcher();
 
   // Cancels the current request.
@@ -71,6 +72,7 @@ class PluginURLFetcher : public webkit_glue::ResourceLoaderBridge::Peer {
   bool notify_redirects_;
   bool is_plugin_src_load_;
   unsigned long resource_id_;
+  bool copy_stream_data_;
   int64 data_offset_;
   bool pending_failure_notification_;
 

content/child/npapi/webplugin_delegate_impl.cc

@@ -11,6 +11,7 @@
 #include "base/message_loop/message_loop.h"
 #include "base/process/process_handle.h"
 #include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
 #include "content/child/npapi/plugin_instance.h"
 #include "content/child/npapi/plugin_lib.h"
 #include "content/child/npapi/plugin_stream_url.h"
@@ -51,6 +52,9 @@ bool WebPluginDelegateImpl::Initialize(
     const std::vector<std::string>& arg_names,
     const std::vector<std::string>& arg_values,
     bool load_manually) {
+  if (instance_->mime_type() == "video/quicktime")
+    quirks_ |= PLUGIN_QUIRK_COPY_STREAM_DATA;
+
   instance_->set_web_plugin(plugin_);
   if (quirks_ & PLUGIN_QUIRK_DONT_ALLOW_MULTIPLE_INSTANCES) {
     PluginLib* plugin_lib = instance()->plugin_lib();
@@ -316,10 +320,11 @@ void WebPluginDelegateImpl::FetchURL(unsigned long resource_id,
   PluginStreamUrl* plugin_stream = instance()->CreateStream(
       resource_id, url, std::string(), notify_id);
 
+  bool copy_stream_data = !!(quirks_ & PLUGIN_QUIRK_COPY_STREAM_DATA);
   plugin_stream->SetPluginURLFetcher(new PluginURLFetcher(
       plugin_stream, url, first_party_for_cookies, method, buf, len,
       referrer, notify_redirects, is_plugin_src_load, origin_pid,
-      render_frame_id, resource_id));
+      render_frame_id, resource_id, copy_stream_data));
 }
 
 }  // namespace content

content/child/npapi/webplugin_delegate_impl.h

@@ -76,6 +76,7 @@ class WebPluginDelegateImpl : public WebPluginDelegate {
     PLUGIN_QUIRK_IGNORE_FIRST_SETWINDOW_CALL = 65536,  // Windows.
     PLUGIN_QUIRK_EMULATE_IME = 131072,  // Windows.
     PLUGIN_QUIRK_FAKE_WINDOW_FROM_POINT = 262144,  // Windows.
+    PLUGIN_QUIRK_COPY_STREAM_DATA = 524288,  // All platforms
   };
 
   static WebPluginDelegateImpl* Create(WebPlugin* plugin,