Code: v8::Handle<v8::Value> AppWindowCustomBindings::GetView(
    const v8::Arguments& args) {
  if (args.Length() != 1)
    return v8::Undefined();

  if (!args[0]->IsInt32())
    return v8::Undefined();

  int view_id = args[0]->Int32Value();

  if (view_id == MSG_ROUTING_NONE)
    return v8::Undefined();

  FindViewByID view_finder(view_id);
  content::RenderView::ForEach(&view_finder);
  content::RenderView* view = view_finder.view();
  if (!view)
    return v8::Undefined();

  content::RenderView* render_view = GetCurrentRenderView();
  if (!render_view)
    return v8::Undefined();
   WebKit::WebFrame* opener = render_view->GetWebView()->mainFrame();
   WebKit::WebFrame* frame = view->GetWebView()->mainFrame();
   frame->setOpener(opener);
 
   v8::Local<v8::Value> window = frame->mainWorldScriptContext()->Global();
   return window;
}

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in the PDF functionality in Google Chrome before 22.0.1229.79 allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted document.
Commit Message: Make chrome.appWindow.create() provide access to the child window at a predictable time.

When you first create a window with chrome.appWindow.create(), it won't have
loaded any resources. So, at create time, you are guaranteed that:

	child_window.location.href == 'about:blank'
	child_window.document.documentElement.outerHTML ==
			'<html><head></head><body></body></html>'

This is in line with the behaviour of window.open().

BUG=131735
TEST=browser_tests:PlatformAppBrowserTest.WindowsApi


Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=144072

Review URL: https://chromiumcodereview.appspot.com/10644006

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@144356 0039d316-1c4b-4281-b951-d872f2087c98