content: Handle native GpuMemoryBuffer allocation failures properly.

content/browser/gpu/browser_gpu_memory_buffer_manager.cc

Index: content/browser/gpu/browser_gpu_memory_buffer_manager.cc
diff --git a/content/browser/gpu/browser_gpu_memory_buffer_manager.cc b/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
index bd7f053edd5f44d84f96111ae3807822255087eb..b6162ba5c4549fc2f22e1644687edb831b0c1828 100644
--- a/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
+++ b/content/browser/gpu/browser_gpu_memory_buffer_manager.cc
@@ -165,7 +165,8 @@ void BrowserGpuMemoryBufferManager::AllocateGpuMemoryBufferForChildProcess(
       new_id, size, format, usage, child_client_id, 0,
       base::Bind(&BrowserGpuMemoryBufferManager::
                      GpuMemoryBufferAllocatedForChildProcess,
-                 weak_ptr_factory_.GetWeakPtr(), child_client_id, callback));
+                 weak_ptr_factory_.GetWeakPtr(), new_id, child_client_id,
+                 callback));
 }
 
 gfx::GpuMemoryBuffer*
@@ -314,6 +315,7 @@ void BrowserGpuMemoryBufferManager::GpuMemoryBufferDeleted(
 }
 
 void BrowserGpuMemoryBufferManager::GpuMemoryBufferAllocatedForChildProcess(
+    gfx::GpuMemoryBufferId id,
     int child_client_id,
     const AllocationCallback& callback,
     const gfx::GpuMemoryBufferHandle& handle) {
@@ -334,19 +336,21 @@ void BrowserGpuMemoryBufferManager::GpuMemoryBufferAllocatedForChildProcess(
 
   BufferMap& buffers = client_it->second;
 
-  BufferMap::iterator buffer_it = buffers.find(handle.id);
+  BufferMap::iterator buffer_it = buffers.find(id);
   DCHECK(buffer_it != buffers.end());
   DCHECK_EQ(buffer_it->second.type, gfx::EMPTY_BUFFER);
 
-  if (handle.is_null()) {
+  // If the handle isn't valid, that means that the GPU process crashed or is
+  // misbehaving so we remove the buffer entry and run the allocation callback
+  // with an empty handle to indicate failure.
+  bool valid_handle = !handle.is_null() && handle.id == id &&
+                      handle.type != gfx::SHARED_MEMORY_BUFFER;
+  if (!valid_handle) {
     buffers.erase(buffer_it);
     callback.Run(gfx::GpuMemoryBufferHandle());
     return;
   }
 
-  // The factory should never return a shared memory backed buffer.
-  DCHECK_NE(handle.type, gfx::SHARED_MEMORY_BUFFER);
-
   // Store the type of this buffer so it can be cleaned up if the child
   // process is removed.
   buffer_it->second.type = handle.type;