Make SharedMemory track the size that was actually mapped

ui/surface/transport_dib_android.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ui/surface/transport_dib.h"
 
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "base/logging.h"
@@ skipping 45 matching lines @@
   return dib.fd >= 0;
 }
 
 // static
 bool TransportDIB::is_valid_id(Id id) {
   // Same as is_valid_handle().
   return id.fd >= 0;
 }
 
 skia::PlatformCanvas* TransportDIB::GetPlatformCanvas(int w, int h) {
-  if (!memory() && !Map())
+  if ((!memory() && !Map()) || !VerifyCanvasSize(w, h))
     return NULL;
   return skia::CreatePlatformCanvas(w, h, true,
                                     reinterpret_cast<uint8_t*>(memory()),
                                     skia::RETURN_NULL_ON_FAILURE);
 }
 
 bool TransportDIB::Map() {
-  if (!is_valid_handle(handle()))
-    return false;
-  // We will use ashmem_get_size_region() to figure out the size in Map(size).
-  if (!shared_memory_.Map(0))
+  if (!is_valid_handle(handle()) || !shared_memory_.Map(0))
     return false;
 
-  // TODO: Note that using created_size() below is a hack. See the comment in
-  // SharedMemory::Map().
-  size_ = shared_memory_.created_size();
+  size_ = shared_memory_.mapped_size();
   return true;
 }
 
 void* TransportDIB::memory() const {
   return shared_memory_.memory();
 }
 
 TransportDIB::Id TransportDIB::id() const {
   // Use FileDescriptor as id.
   return shared_memory_.handle();
 }
 
 TransportDIB::Handle TransportDIB::handle() const {
   return shared_memory_.handle();
 }