Convert plugin and GPU process to brokered handle duplication.

content/common/gpu/gpu_command_buffer_stub.cc

  // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #if defined(ENABLE_GPU)
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/debug/trace_event.h"
 #include "base/shared_memory.h"
 #include "base/time.h"
 #include "build/build_config.h"
 #include "content/common/gpu/gpu_channel.h"
 #include "content/common/gpu/gpu_channel_manager.h"
 #include "content/common/gpu/gpu_command_buffer_stub.h"
 #include "content/common/gpu/gpu_memory_manager.h"
 #include "content/common/gpu/gpu_messages.h"
 #include "content/common/gpu/gpu_watchdog.h"
 #include "content/common/gpu/image_transport_surface.h"
 #include "gpu/command_buffer/common/constants.h"
 #include "gpu/command_buffer/common/gles2_cmd_utils.h"
 #include "ui/gfx/gl/gl_bindings.h"
 #include "ui/gfx/gl/gl_switches.h"
 
+#if defined(OS_WIN)
+#include "content/common/sandbox_policy.h"
+#endif
+
 GpuCommandBufferStub::SurfaceState::SurfaceState(int32 surface_id,
                                                  bool visible,
                                                  base::TimeTicks last_used_time)
     : surface_id(surface_id),
       visible(visible),
       last_used_time(last_used_time) {
 }
 
 GpuCommandBufferStub::GpuCommandBufferStub(
     GpuChannel* channel,
@@ skipping 425 matching lines @@
     reply_message->set_reply_error();
   }
   Send(reply_message);
 }
 
 void GpuCommandBufferStub::OnRegisterTransferBuffer(
     base::SharedMemoryHandle transfer_buffer,
     size_t size,
     int32 id_request,
     IPC::Message* reply_message) {
-#if defined(OS_WIN)
-  // Windows dups the shared memory handle it receives into the current process
-  // and closes it when this variable goes out of scope.
-  base::SharedMemory shared_memory(transfer_buffer,
-                                   false,
-                                   channel_->renderer_process());
-#else
-  // POSIX receives a dup of the shared memory handle and closes the dup when
-  // this variable goes out of scope.
   base::SharedMemory shared_memory(transfer_buffer, false);
-#endif
 
   if (command_buffer_.get()) {
     int32 id = command_buffer_->RegisterTransferBuffer(&shared_memory,
                                                        size,
                                                        id_request);
     GpuCommandBufferMsg_RegisterTransferBuffer::WriteReplyParams(reply_message,
                                                                  id);
   } else {
     reply_message->set_reply_error();
   }
 
   Send(reply_message);
 }
 
 void GpuCommandBufferStub::OnDestroyTransferBuffer(
     int32 id,
     IPC::Message* reply_message) {
   if (command_buffer_.get()) {
     command_buffer_->DestroyTransferBuffer(id);
   } else {
     reply_message->set_reply_error();
   }
   Send(reply_message);
 }
 
 void GpuCommandBufferStub::OnGetTransferBuffer(
     int32 id,
     IPC::Message* reply_message) {
-  // Fail if the renderer process has not provided its process handle.
-  if (!channel_->renderer_process())
-    return;
-
   if (command_buffer_.get()) {
     base::SharedMemoryHandle transfer_buffer = base::SharedMemoryHandle();
     uint32 size = 0;
 
     gpu::Buffer buffer = command_buffer_->GetTransferBuffer(id);
     if (buffer.shared_memory) {
-      // Assume service is responsible for duplicating the handle to the calling
-      // process.
-      buffer.shared_memory->ShareToProcess(channel_->renderer_process(),
+#if defined(OS_WIN)
+      transfer_buffer = NULL;
+      sandbox::BrokerDuplicateHandle(buffer.shared_memory->handle(),
+          channel_->renderer_pid(), &transfer_buffer, FILE_MAP_WRITE, 0);
+      DCHECK(transfer_buffer != NULL);

[apatrick_chromium, 2012/04/09 18:40:58]

It might be better to crash if you think this could fail. Otherwise the GPU
process has a handy null pointer to work with.

[jschuh, 2012/04/10 19:02:12]

It should fail only on a policy violation or a dead target. That said, it would
be bad to have the NULL hanging around, so I'll do a hard CHECK.

+#else
+      buffer.shared_memory->ShareToProcess(channel_->renderer_pid(),
                                            &transfer_buffer);
+#endif
       size = buffer.size;
     }
 
     GpuCommandBufferMsg_GetTransferBuffer::WriteReplyParams(reply_message,
                                                             transfer_buffer,
                                                             size);
   } else {
     reply_message->set_reply_error();
   }
   Send(reply_message);
@@ skipping 17 matching lines @@
 void GpuCommandBufferStub::OnCreateVideoDecoder(
     media::VideoCodecProfile profile,
     IPC::Message* reply_message) {
   int decoder_route_id = channel_->GenerateRouteID();
   GpuCommandBufferMsg_CreateVideoDecoder::WriteReplyParams(
       reply_message, decoder_route_id);
   GpuVideoDecodeAccelerator* decoder =
       new GpuVideoDecodeAccelerator(this, decoder_route_id, this);
   video_decoders_.AddWithID(decoder, decoder_route_id);
   channel_->AddRoute(decoder_route_id, decoder);
-  decoder->Initialize(profile, reply_message,
-                      channel_->renderer_process());
+  decoder->Initialize(profile, reply_message);
 }
 
 void GpuCommandBufferStub::OnDestroyVideoDecoder(int decoder_route_id) {
   channel_->RemoveRoute(decoder_route_id);
   video_decoders_.Remove(decoder_route_id);
 }
 
 void GpuCommandBufferStub::OnSetSurfaceVisible(bool visible) {
   DCHECK(surface_state_.get());
   surface_state_->visible = visible;
@@ skipping 64 matching lines @@
 }
 
 void GpuCommandBufferStub::SetMemoryAllocation(
     const GpuMemoryAllocation& allocation) {
   allocation_ = allocation;
 
   SendMemoryAllocationToProxy(allocation);
 }
 
 #endif  // defined(ENABLE_GPU)