Abstract: One embodiment of the present application includes an approach by which an animation system manipulates an animatable object. The animation system detects that a pointer device has positioned a pointer location at a first location, the first location coinciding with a first portion of geometry of the animatable object. The animation system indicates that a first manipulator associated with the first portion of geometry is tentatively selected. Prior to receiving a selection event from the pointer device, the animation system displays a representation of the first manipulator.

Abstract: One embodiment of the present application includes an approach by which an animation system manipulates an animatable object. The animation system detects that a pointer device has positioned a pointer location at a first location, the first location coinciding with a first portion of geometry of the animatable object. The animation system indicates that a first manipulator associated with the first portion of geometry is tentatively selected. Prior to receiving a selection event from the pointer device, the animation system displays a representation of the first manipulator.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, support a browser privacy mode in a plugin of the browser. In one aspect, a method includes applying a private browsing mode of a browser in a plugin program of the browser, the applying including: obtaining, in a process, an indication of the private browsing mode of the browser; specifying, in response to the indication, that an instance of the plugin program initiated within the process is set to run in a private data mode that cannot be exited; receiving, in the instance of the plugin program initiated within the process and set to run in the private data mode, information that results in locally cached data; and saving, in response to the receiving, the locally cached data entirely in volatile memory without saving to persistent storage.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for providing a hierarchical data structure to store nodes, wherein the nodes comprise graphical primitives to be rendered to a common display space of a computer system. The hierarchical data structure governs graphical compositing amongst the nodes. Two or more separate software applications are allowed to create nodes in the hierarchical data structure and share the common display space. The two or more separate software applications are restricted from accessing nodes in the hierarchical data structure based on node ownership information linking one or more nodes in the hierarchical data structure to a respective software application in the two or more separate software applications. The hierarchical data structure is used for rendering and displaying the common display space.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for integrating separate software applications in an application execution environment, where the method includes providing a hierarchical structure of nodes corresponding to user interface objects representing elements of a user interface of a computer, wherein the hierarchical structure governs propagation of user interface events among the user interface objects; the providing includes enabling separate software applications to concurrently create nodes in the hierarchical structure and share the user interface; and restricting propagation of user interface events among the user interface objects, during presentation of the user interface objects in the user interface of the computer, based on node ownership information linking the user interface objects to the separate software applications. Other embodiments of this aspect include corresponding systems, apparatus, and computer program products.

Abstract: A system and method provides a service, such as complete access to a file or a socket request, in response to a file describing permissions for individual or multiple domains.

Abstract: A security application is described for determining conditions within a computer application that would create the desire to allow or disallow access to certain system functions or features by the application. The security application analyzes the conditions and sets a lock that enables the application to perform only certain types of actions that would be considered secure by the security application.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for receiving a request, from an application in an application execution environment, to play a media asset that has associated media information. The application has associated application information and is restricted to an isolation environment provided by the application execution environment. In response to the request, content of the media asset is provided to a component of a computer system for playing. Access by the application to the content of the media asset during the playing is restricted based on the media information and the application information.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for receiving a request, from an application in an application execution environment, to play a media asset that has associated media information. The application has associated application information and is restricted to an isolation environment provided by the application execution environment. In response to the request, content of the media asset is provided to a component of a computer system for playing. Access by the application to the content of the media asset during the playing is restricted based on the media information and the application information.

Abstract: This specification describes technologies relating to execution of applications and the management of an application's access to other applications. In general, a method can include loading a first application, designated to a first isolation environment, including first instructions using the first isolation environment provided by an application execution environment. A second application including second instructions is loaded using the first isolation environment despite the second application being designated to a second isolation environment provided by the application execution environment. The first application is prevented from modifying the second instructions of the second application. Data is processed using the first instructions of the first application and the second instructions of the second application, where the first instructions reference the second instructions. Information based on results of the processing is outputted.

Abstract: This specification describes technologies relating to execution of applications and the management of an application's access to other applications. In general, a method can include loading a first application, designated to a first isolation environment, including first instructions using the first isolation environment provided by an application execution environment. A second application including second instructions is loaded using the first isolation environment despite the second application being designated to a second isolation environment provided by the application execution environment. The first application is prevented from modifying the second instructions of the second application. Data is processed using the first instructions of the first application and the second instructions of the second application, where the first instructions reference the second instructions. Information based on results of the processing is outputted.

Abstract: A system and method provides a service, such as complete access to a file or a socket request, in response to a file describing permissions for individual or multiple domains.

Abstract: Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, support a browser privacy mode in a plugin of the browser. In one aspect, a method includes applying a private browsing mode of a browser in a plugin program of the browser, the applying including: obtaining, in a process, an indication of the private browsing mode of the browser; specifying, in response to the indication, that an instance of the plugin program initiated within the process is set to run in a private data mode that cannot be exited; receiving, in the instance of the plugin program initiated within the process and set to run in the private data mode, information that results in locally cached data; and saving, in response to the receiving, the locally cached data entirely in volatile memory without saving to persistent storage.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for integrating separate software applications in an application execution environment, where the method includes providing a hierarchical structure of nodes corresponding to user interface objects representing elements of a user interface of a computer, wherein the hierarchical structure governs propagation of user interface events among the user interface objects; the providing includes enabling separate software applications to concurrently create nodes in the hierarchical structure and share the user interface; and restricting propagation of user interface events among the user interface objects, during presentation of the user interface objects in the user interface of the computer, based on node ownership information linking the user interface objects to the separate software applications. Other embodiments of this aspect include corresponding systems, apparatus, and computer program products.

Abstract: A security application is described for determining conditions within a computer application that would create the desire to allow or disallow access to certain system functions or features by the application. The security application analyzes the conditions and sets a lock that enables the application to perform only certain types of actions that would be considered secure by the security application.

Abstract: In general, one aspect of the subject matter described in this specification can be embodied in a method for integrating separate software applications in an application execution environment, where the method includes providing a hierarchical structure of nodes corresponding to user interface objects representing elements of a user interface of a computer, wherein the hierarchical structure governs propagation of user interface events among the user interface objects; the providing includes enabling separate software applications to concurrently create nodes in the hierarchical structure and share the user interface; and restricting propagation of user interface events among the user interface objects, during presentation of the user interface objects in the user interface of the computer, based on node ownership information linking the user interface objects to the separate software applications. Other embodiments of this aspect include corresponding systems, apparatus, and computer program products.

Abstract: This specification describes technologies relating to execution of applications and the management of an application's access to other applications. In general, a method can include loading a first application, designated to a first isolation environment, including first instructions using the first isolation environment provided by an application execution environment. A second application including second instructions is loaded using the first isolation environment despite the second application being designated to a second isolation environment provided by the application execution environment. The first application is prevented from modifying the second instructions of the second application. Data is processed using the first instructions of the first application and the second instructions of the second application, where the first instructions reference the second instructions. Information based on results of the processing is outputted.

Abstract: A security application is described for determining conditions within a computer application that would create the desire to allow or disallow access to certain system functions or features by the application. The security application analyzes the conditions and sets a lock that enables the application to perform only certain types of actions that would be considered secure by the security application.