Fix 2 Dr. Memory issues

gpu/command_buffer/client/gles2_implementation.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A class to emulate GLES2 over command buffers.
 
 #include "../client/gles2_implementation.h"
 
 #include <GLES2/gl2ext.h>
 #include <GLES2/gles2_command_buffer.h>
@@ skipping 1366 matching lines @@
     return;
   }
 
   GLsizei original_height = height;
   if (padded_row_size <= max_size) {
     // Transfer by rows.
     GLint max_rows = max_size / std::max(padded_row_size,
                                          static_cast<GLsizeiptr>(1));
     while (height) {
       GLint num_rows = std::min(height, max_rows);
-      GLsizeiptr part_size = num_rows * padded_row_size;
+      GLsizeiptr part_size =
+          (num_rows - 1) * padded_row_size + unpadded_row_size;
       void* buffer = transfer_buffer_.Alloc(part_size);
       GLint y;
       if (unpack_flip_y_) {
         CopyRectToBufferFlipped(
             source, width, num_rows, format, type, buffer);
         // GPU_DCHECK(copy_success);  // can't check this because bot fails!
         y = original_height - yoffset - num_rows;
       } else {
         memcpy(buffer, source, part_size);
         y = yoffset;
       }
       helper_->TexSubImage2D(
           target, level, xoffset, y, width, num_rows, format, type,
           transfer_buffer_id_, transfer_buffer_.GetOffset(buffer), internal);
       transfer_buffer_.FreePendingToken(buffer, helper_->InsertToken());
       yoffset += num_rows;
-      source += part_size;
+      source += num_rows * padded_row_size;
       height -= num_rows;
     }
   } else {
     // Transfer by sub rows. Because GL has no maximum texture dimensions.
     uint32 temp;
     GLES2Util::ComputeImageDataSize(
        1, 1, format, type, unpack_alignment_, &temp);
     GLsizeiptr element_size = temp;
     max_size -= max_size % element_size;
     GLint max_sub_row_pixels = max_size / element_size;
@@ skipping 319 matching lines @@
     // Transfer by rows.
     // The max rows we can transfer.
     GLint max_rows = max_size / std::max(padded_row_size,
                                          static_cast<GLsizeiptr>(1));
     while (height) {
       // Compute how many rows to transfer.
       GLint num_rows = std::min(height, max_rows);
       // Compute how much space those rows will take. The last row will not
       // include padding.
       GLsizeiptr part_size =
-          unpadded_row_size + (padded_row_size * std::max(num_rows - 1, 0));
+          unpadded_row_size + padded_row_size * (num_rows - 1);
       void* buffer = transfer_buffer_.Alloc(part_size);
       *result = 0;  // mark as failed.
       helper_->ReadPixels(
           xoffset, yoffset, width, num_rows, format, type,
           transfer_buffer_id_, transfer_buffer_.GetOffset(buffer),
           result_shm_id(), result_shm_offset());
       WaitForCmd();
       if (*result != 0) {
         // We have to copy 1 row at a time to avoid writing pad bytes.
         const int8* src = static_cast<const int8*>(buffer);
@@ skipping 605 matching lines @@
   if (static_cast<size_t>(bufsize) < result.size()) {
     SetGLError(GL_INVALID_OPERATION,
                "glProgramInfoCHROMIUM: bufsize is too small for result.");
     return;
   }
   memcpy(info, &result[0], result.size());
 }
 
 }  // namespace gles2
 }  // namespace gpu