Code: std::string TestFlashMessageLoop::TestRunWithoutQuit() {
  message_loop_ = new pp::flash::MessageLoop(instance_);

  pp::CompletionCallback callback = callback_factory_.NewCallback(
      &TestFlashMessageLoop::DestroyMessageLoopResourceTask);
  pp::Module::Get()->core()->CallOnMainThread(0, callback);
  int32_t result = message_loop_->Run();
 
   if (message_loop_) {
     delete message_loop_;
    message_loop_ = NULL;
     ASSERT_TRUE(false);
   }
 
   ASSERT_EQ(PP_ERROR_ABORTED, result);
   PASS();
 }

Vulnerability Type: Bypass 
CWE ID: CWE-264
Summary: The PPB_Flash_MessageLoop_Impl::InternalRun function in content/renderer/pepper/ppb_flash_message_loop_impl.cc in the Pepper plugin in Google Chrome before 49.0.2623.75 mishandles nested message loops, which allows remote attackers to bypass the Same Origin Policy via a crafted web site.
Commit Message: Fix PPB_Flash_MessageLoop.

This CL suspends script callbacks and resource loads while running nested message loop using PPB_Flash_MessageLoop.

BUG=569496

Review URL: https://codereview.chromium.org/1559113002

Cr-Commit-Position: refs/heads/master@{#374529}