Moved creation of GPU transfer buffers into the browser process....

chrome/renderer/command_buffer_proxy.cc

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/logging.h"
 #include "base/process_util.h"
 #include "base/shared_memory.h"
 #include "base/task.h"
 #include "chrome/common/gpu_messages.h"
 #include "chrome/common/plugin_messages.h"
+#include "chrome/common/render_messages.h"
 #include "chrome/renderer/command_buffer_proxy.h"
 #include "chrome/renderer/plugin_channel_host.h"
+#include "chrome/renderer/render_thread.h"
 #include "gpu/command_buffer/common/cmd_buffer_common.h"
 #include "ui/gfx/size.h"
 
 using gpu::Buffer;
 
 CommandBufferProxy::CommandBufferProxy(
     IPC::Channel::Sender* channel,
     int route_id)
     : num_entries_(0),
       channel_(channel),
@@ skipping 93 matching lines @@
 
   return last_state_;
 }
 
 void CommandBufferProxy::SetGetOffset(int32 get_offset) {
   // Not implemented in proxy.
   NOTREACHED();
 }
 
 int32 CommandBufferProxy::CreateTransferBuffer(size_t size) {
-  if (last_state_.error == gpu::error::kNoError) {
-    int32 id;
-    if (Send(new GpuCommandBufferMsg_CreateTransferBuffer(route_id_,
-                                                          size,
-                                                          &id))) {
-      return id;
-    }
+  if (last_state_.error != gpu::error::kNoError)
+    return -1;
+
+  RenderThread* render_thread = RenderThread::current();
+  if (!render_thread)
+    return -1;
+
+  base::SharedMemoryHandle handle;
+  if (!render_thread->Send(new ViewHostMsg_AllocateSharedMemoryBuffer(
+      size,
+      &handle))) {
+    return -1;
   }
 
-  return -1;
+  // Take ownership of shared memory. This will close the handle if Send below
+  // fails. Otherwise, callee takes ownership before this variable
+  // goes out of scope by duping the handle.
+  base::SharedMemory shared_memory(handle, false);

[piman, 2011/02/25 04:13:48]

This is wrong on posix.
When sending the handle (base::FileDescriptor), it will always be destroyed
whether Send succeeds or not.
The side effect of this is that the fd gets closed twice - once when this goes
out of scope, and once again when the message is sent on the IPC thread. The
second close may close another arbitrary fd that got open in the mean time with
the same number.

+
+  int32 id;
+  if (!Send(new GpuCommandBufferMsg_RegisterTransferBuffer(route_id_,
+                                                           handle,
+                                                           size,
+                                                           &id))) {
+    return -1;
+  }
+
+  return id;
+}
+
+int32 CommandBufferProxy::RegisterTransferBuffer(
+    base::SharedMemory* shared_memory,
+    size_t size) {
+  if (last_state_.error != gpu::error::kNoError)
+    return -1;
+
+  int32 id;
+  if (!Send(new GpuCommandBufferMsg_RegisterTransferBuffer(
+      route_id_,
+      shared_memory->handle(),
+      size,
+      &id))) {
+    return -1;
+  }
+
+  return id;
 }
 
 void CommandBufferProxy::DestroyTransferBuffer(int32 id) {
   if (last_state_.error != gpu::error::kNoError)
     return;
 
-  // Remove the transfer buffer from the client side4 cache.
+  // Remove the transfer buffer from the client side cache.
   TransferBufferMap::iterator it = transfer_buffers_.find(id);
-  DCHECK(it != transfer_buffers_.end());
-
-  // Delete the shared memory object, closing the handle in this process.
-  delete it->second.shared_memory;
-
-  transfer_buffers_.erase(it);
+  if (it != transfer_buffers_.end()) {
+    delete it->second.shared_memory;
+    transfer_buffers_.erase(it);
+  }
 
   Send(new GpuCommandBufferMsg_DestroyTransferBuffer(route_id_, id));
 }
 
 Buffer CommandBufferProxy::GetTransferBuffer(int32 id) {
   if (last_state_.error != gpu::error::kNoError)
     return Buffer();
 
   // Check local cache to see if there is already a client side shared memory
   // object for this id.
@@ skipping 154 matching lines @@
   pending_async_flush_tasks_.pop();
 
   if (task.get()) {
     // Although we need need to update last_state_ while potentially waiting
     // for a synchronous flush to complete, we do not need to invoke the
     // callback synchonously. Also, post it as a non nestable task so it is
     // always invoked by the outermost message loop.
     MessageLoop::current()->PostNonNestableTask(FROM_HERE, task.release());
   }
 }