On Windows, create a new TransportDIB::Handle struct which includes the file

app/surface/transport_dib_mac.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "app/surface/transport_dib.h"
 
 #include <unistd.h>
 #include <sys/stat.h>
 
 #include "base/eintr_wrapper.h"
 #include "base/logging.h"
 #include "base/scoped_ptr.h"
 #include "base/shared_memory.h"
 #include "skia/ext/platform_canvas.h"
 
+void TransportDIB::ScopedHandle::Close() {
+  if (is_valid(handle_))
+    base::SharedMemory::CloseHandle(handle_);
+}

[Scott Hess - ex-Googler, 2010/10/25 21:38:19]

AFAICT, handle_ is a file descriptor, and since this doesn't reset to
DefaultHandle(), if Close() is called outside the destructor, it will be called
again in the destructor, which may result in closing someone else's file
descriptor.

Or did I miss something?

See http://crbug.com/60313

[kkania, 2010/10/27 18:12:59]

That is correct. However, since Close() is private and currently called only by
the destructor, it is ok. It might be a good idea to go ahead and reset it
anyways though.

[Scott Hess - ex-Googler, 2010/10/27 19:34:02]

Not if you happen to be multi-threaded.
+1.

+
 TransportDIB::TransportDIB()
     : size_(0) {
 }
 
 TransportDIB::TransportDIB(TransportDIB::Handle dib)
     : shared_memory_(dib, false /* read write */),
       size_(0) {
 }
 
 TransportDIB::~TransportDIB() {
 }
 
 // static
 TransportDIB* TransportDIB::Create(size_t size, uint32 sequence_num) {
   TransportDIB* dib = new TransportDIB;
   if (!dib->shared_memory_.Create("", false /* read write */,
                                   false /* do not open existing */, size)) {
     delete dib;
     return NULL;
   }
 
-  if (!dib->shared_memory_.Map(size)) {
-    delete dib;
-    return NULL;
-  }
-
   dib->size_ = size;
   return dib;
 }
 
 // static
-TransportDIB* TransportDIB::Map(TransportDIB::Handle handle) {
-  if (!is_valid(handle))
+TransportDIB* TransportDIB::Map(Handle handle) {
+  scoped_ptr<TransportDIB> dib(CreateWithHandle(handle));
+  if (!dib->Map())
     return NULL;
-
-  TransportDIB* dib = new TransportDIB(handle);
-  struct stat st;
-  if ((fstat(handle.fd, &st) != 0) ||
-      (!dib->shared_memory_.Map(st.st_size))) {
-    delete dib;
-    if (HANDLE_EINTR(close(handle.fd)) < 0)
-      PLOG(ERROR) << "close";
-    return NULL;
-  }
-
-  dib->size_ = st.st_size;
-
-  return dib;
+  return dib.release();
 }
 
+// static
+TransportDIB* TransportDIB::CreateWithHandle(Handle handle) {
+  return new TransportDIB(handle);
+}
+
+// static
 bool TransportDIB::is_valid(Handle dib) {
   return dib.fd >= 0;
 }
 
 skia::PlatformCanvas* TransportDIB::GetPlatformCanvas(int w, int h) {
+  if (!memory() && !Map())
+    return NULL;
   scoped_ptr<skia::PlatformCanvas> canvas(new skia::PlatformCanvas);
   if (!canvas->initialize(w, h, true, reinterpret_cast<uint8_t*>(memory())))
     return NULL;
   return canvas.release();
 }
 
+bool TransportDIB::Map() {
+  if (memory())
+    return true;
+
+  struct stat st;
+  if ((fstat(shared_memory_.handle().fd, &st) != 0) ||
+      (!shared_memory_.Map(st.st_size))) {
+    return false;
+  }
+
+  size_ = st.st_size;
+  return true;
+}
+
+TransportDIB::Handle TransportDIB::GetHandleForProcess(
+    base::ProcessHandle process_handle) const {
+  return handle();
+}
+
 void* TransportDIB::memory() const {
   return shared_memory_.memory();
 }
 
 TransportDIB::Id TransportDIB::id() const {
   return shared_memory_.id();
 }
 
 TransportDIB::Handle TransportDIB::handle() const {
   return shared_memory_.handle();
 }