Convert plugin and GPU process to brokered handle duplication.

content/common/gpu/client/command_buffer_proxy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/gpu/client/command_buffer_proxy_impl.h"
 
 #include "base/callback.h"
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
 #include "base/process_util.h"
 #include "base/shared_memory.h"
 #include "base/stl_util.h"
 #include "content/common/child_process_messages.h"
 #include "content/common/gpu/gpu_memory_allocation.h"
 #include "content/common/gpu/client/gpu_channel_host.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/plugin_messages.h"
 #include "content/common/view_messages.h"
 #include "gpu/command_buffer/common/cmd_buffer_common.h"
 #include "gpu/command_buffer/common/command_buffer_shared.h"
 #include "ui/gfx/size.h"
 
+#if defined(OS_WIN)
+#include "content/common/sandbox_policy.h"
+#endif
+
 using gpu::Buffer;
 
 CommandBufferProxyImpl::CommandBufferProxyImpl(
     GpuChannelHost* channel,
     int route_id)
     : channel_(channel),
       route_id_(route_id),
       flush_count_(0),
       last_put_offset_(-1) {
 }
@@ skipping 194 matching lines @@
 
   // Take ownership of shared memory. This will close the handle if Send below
   // fails. Otherwise, callee takes ownership before this variable
   // goes out of scope by duping the handle.
   scoped_ptr<base::SharedMemory> shm(
       channel_->factory()->AllocateSharedMemory(size));
   if (!shm.get())
     return -1;
 
   base::SharedMemoryHandle handle = shm->handle();
-#if defined(OS_POSIX)
+#if defined(OS_WIN)
+  // Windows needs to explicitly duplicate the handle out to another process.
+  if (!sandbox::BrokerDuplicateHandle(handle, channel_->gpu_process_id(),
+                                      &handle, FILE_MAP_WRITE, 0)) {
+    return -1;
+  }
+#elif defined(OS_POSIX)
   DCHECK(!handle.auto_close);
 #endif
 
   int32 id;
   if (!Send(new GpuCommandBufferMsg_RegisterTransferBuffer(route_id_,
                                                            handle,
                                                            size,
                                                            id_request,
                                                            &id))) {
     return -1;
   }
 
   return id;
 }
 
 int32 CommandBufferProxyImpl::RegisterTransferBuffer(
     base::SharedMemory* shared_memory,
     size_t size,
     int32 id_request) {
   if (last_state_.error != gpu::error::kNoError)
     return -1;
 
+  // Returns FileDescriptor with auto_close off.
+  base::SharedMemoryHandle handle = shared_memory->handle();
+#if defined(OS_WIN)
+  // Windows needs to explicitly duplicate the handle out to another process.
+  if (!sandbox::BrokerDuplicateHandle(handle, channel_->gpu_process_id(),
+                                      &handle, FILE_MAP_WRITE, 0)) {
+    return -1;
+  }
+#endif
+
   int32 id;
   if (!Send(new GpuCommandBufferMsg_RegisterTransferBuffer(
       route_id_,
-      shared_memory->handle(),  // Returns FileDescriptor with auto_close off.
+      handle,
       size,
       id_request,
       &id))) {
     return -1;
   }
 
   return id;
 }
 
 void CommandBufferProxyImpl::DestroyTransferBuffer(int32 id) {
@@ skipping 206 matching lines @@
 
 void CommandBufferProxyImpl::SetOnConsoleMessageCallback(
     const GpuConsoleMessageCallback& callback) {
   console_message_callback_ = callback;
 }
 
 void CommandBufferProxyImpl::TryUpdateState() {
   if (last_state_.error == gpu::error::kNoError)
     shared_state_->Read(&last_state_);
 }