Code:  void DelegatedFrameHost::CopyFromCompositingSurface(
     const gfx::Rect& src_subrect,
    const gfx::Size& dst_size,
     const base::Callback<void(bool, const SkBitmap&)>& callback,
     const SkColorType color_type) {
  bool format_support = ((color_type == kRGB_565_SkColorType) ||
                         (color_type == kN32_SkColorType));
  DCHECK(format_support);
  if (!CanCopyToBitmap()) {
    callback.Run(false, SkBitmap());
     return;
   }
 
  const gfx::Size& dst_size_in_pixel =
      client_->ConvertViewSizeToPixel(dst_size);
   scoped_ptr<cc::CopyOutputRequest> request =
       cc::CopyOutputRequest::CreateRequest(base::Bind(
           &DelegatedFrameHost::CopyFromCompositingSurfaceHasResult,
          dst_size_in_pixel,
           color_type,
           callback));
  gfx::Rect src_subrect_in_pixel =
      ConvertRectToPixel(client_->CurrentDeviceScaleFactor(), src_subrect);
  request->set_area(src_subrect_in_pixel);
   client_->RequestCopyOfOutput(request.Pass());
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Double free vulnerability in the ResourceFetcher::didLoadResource function in core/fetch/ResourceFetcher.cpp in the resource loader in Blink, as used in Google Chrome before 30.0.1599.66, allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering certain callback processing during the reporting of a resource entry.
Commit Message: repairs CopyFromCompositingSurface in HighDPI

This CL removes the DIP=>Pixel transform in
DelegatedFrameHost::CopyFromCompositingSurface(), because said
transformation seems to be happening later in the copy logic
and is currently being applied twice.

BUG=397708

Review URL: https://codereview.chromium.org/421293002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@286414 0039d316-1c4b-4281-b951-d872f2087c98