Convert plugin and GPU process to brokered handle duplication.

content/common/gpu/gpu_command_buffer_stub.cc

Index: content/common/gpu/gpu_command_buffer_stub.cc
===================================================================
--- content/common/gpu/gpu_command_buffer_stub.cc	(revision 131361)
+++ content/common/gpu/gpu_command_buffer_stub.cc	(working copy)
@@ -23,6 +23,10 @@
 #include "ui/gfx/gl/gl_bindings.h"
 #include "ui/gfx/gl/gl_switches.h"
 
+#if defined(OS_WIN)
+#include "content/common/sandbox_policy.h"
+#endif
+
 GpuCommandBufferStub::SurfaceState::SurfaceState(int32 surface_id,
                                                  bool visible,
                                                  base::TimeTicks last_used_time)
@@ -468,17 +472,7 @@
     size_t size,
     int32 id_request,
     IPC::Message* reply_message) {
-#if defined(OS_WIN)
-  // Windows dups the shared memory handle it receives into the current process
-  // and closes it when this variable goes out of scope.
-  base::SharedMemory shared_memory(transfer_buffer,
-                                   false,
-                                   channel_->renderer_process());
-#else
-  // POSIX receives a dup of the shared memory handle and closes the dup when
-  // this variable goes out of scope.
   base::SharedMemory shared_memory(transfer_buffer, false);
-#endif
 
   if (command_buffer_.get()) {
     int32 id = command_buffer_->RegisterTransferBuffer(&shared_memory,
@@ -507,20 +501,21 @@
 void GpuCommandBufferStub::OnGetTransferBuffer(
     int32 id,
     IPC::Message* reply_message) {
-  // Fail if the renderer process has not provided its process handle.
-  if (!channel_->renderer_process())
-    return;
-
   if (command_buffer_.get()) {
     base::SharedMemoryHandle transfer_buffer = base::SharedMemoryHandle();
     uint32 size = 0;
 
     gpu::Buffer buffer = command_buffer_->GetTransferBuffer(id);
     if (buffer.shared_memory) {
-      // Assume service is responsible for duplicating the handle to the calling
-      // process.
-      buffer.shared_memory->ShareToProcess(channel_->renderer_process(),
+#if defined(OS_WIN)
+      transfer_buffer = NULL;
+      sandbox::BrokerDuplicateHandle(buffer.shared_memory->handle(),
+          channel_->renderer_pid(), &transfer_buffer, FILE_MAP_WRITE, 0);
+      DCHECK(transfer_buffer != NULL);

[apatrick_chromium, 2012/04/09 18:40:58]

It might be better to crash if you think this could fail. Otherwise the GPU
process has a handy null pointer to work with.

[jschuh, 2012/04/10 19:02:12]

It should fail only on a policy violation or a dead target. That said, it would
be bad to have the NULL hanging around, so I'll do a hard CHECK.

+#else
+      buffer.shared_memory->ShareToProcess(channel_->renderer_pid(),
                                            &transfer_buffer);
+#endif
       size = buffer.size;
     }
 
@@ -558,8 +553,7 @@
       new GpuVideoDecodeAccelerator(this, decoder_route_id, this);
   video_decoders_.AddWithID(decoder, decoder_route_id);
   channel_->AddRoute(decoder_route_id, decoder);
-  decoder->Initialize(profile, reply_message,
-                      channel_->renderer_process());
+  decoder->Initialize(profile, reply_message);
 }
 
 void GpuCommandBufferStub::OnDestroyVideoDecoder(int decoder_route_id) {