Use CheckedNumerics in AsyncPixelTransfersCompletedQuery, add tests

gpu/command_buffer/service/query_manager.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/query_manager.h"
 
 #include "base/atomicops.h"
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
+#include "base/numerics/safe_math.h"
 #include "base/synchronization/lock.h"
 #include "base/time/time.h"
 #include "gpu/command_buffer/common/gles2_cmd_format.h"
 #include "gpu/command_buffer/service/async_pixel_transfer_manager.h"
 #include "gpu/command_buffer/service/error_state.h"
 #include "gpu/command_buffer/service/feature_info.h"
 #include "gpu/command_buffer/service/gles2_cmd_decoder.h"
 
 namespace gpu {
 namespace gles2 {
@@ skipping 67 matching lines @@
   AsyncMemoryParams mem_params;
   // Get the real shared memory since it might need to be duped to prevent
   // use-after-free of the memory.
   Buffer buffer = manager()->decoder()->GetSharedMemoryBuffer(shm_id());
   if (!buffer.shared_memory)
     return false;
   mem_params.shared_memory = buffer.shared_memory;
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
-  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
-  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)
+  base::CheckedNumeric<uint32> end = mem_params.shm_data_offset;
+  end += mem_params.shm_data_size;
+  if (!end.IsValid() || end.ValueOrDie() > mem_params.shm_size)
     return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);
 
   // Ask AsyncPixelTransferDelegate to run completion callback after all
   // previous async transfers are done. No guarantee that callback is run
   // on the current thread.
   manager()->decoder()->GetAsyncPixelTransferManager()
       ->AsyncNotifyCompletion(mem_params, observer_);
 
@@ skipping 187 matching lines @@
       QueryManager* manager, GLenum target, int32 shm_id, uint32 shm_offset);
 
   virtual bool Begin() OVERRIDE;
   virtual bool End(base::subtle::Atomic32 submit_count) OVERRIDE;
   virtual bool Process() OVERRIDE;
   virtual void Destroy(bool have_context) OVERRIDE;
 
  protected:
   void Complete();
   virtual ~AsyncReadPixelsCompletedQuery();
+
+ private:
+  bool completed_;
+  bool complete_result_;
 };
 
 AsyncReadPixelsCompletedQuery::AsyncReadPixelsCompletedQuery(
     QueryManager* manager, GLenum target, int32 shm_id, uint32 shm_offset)
-    : Query(manager, target, shm_id, shm_offset) {
+    : Query(manager, target, shm_id, shm_offset),
+      completed_(false),
+      complete_result_(false) {
 }
 
 bool AsyncReadPixelsCompletedQuery::Begin() {
   return true;
 }
 
 bool AsyncReadPixelsCompletedQuery::End(base::subtle::Atomic32 submit_count) {
   if (!AddToPendingQueue(submit_count)) {
     return false;
   }
   manager()->decoder()->WaitForReadPixels(
       base::Bind(&AsyncReadPixelsCompletedQuery::Complete,
                  AsWeakPtr()));
 
-  return true;
+  return Process();
 }
 
 void AsyncReadPixelsCompletedQuery::Complete() {
-  MarkAsCompleted(1);
+  completed_ = true;
+  complete_result_ = MarkAsCompleted(1);
 }
 
 bool AsyncReadPixelsCompletedQuery::Process() {
-  return true;
+  return !completed_ || complete_result_;
 }
 
 void AsyncReadPixelsCompletedQuery::Destroy(bool /* have_context */) {
   if (!IsDeleted()) {
     MarkAsDeleted();
   }
 }
 
 AsyncReadPixelsCompletedQuery::~AsyncReadPixelsCompletedQuery() {
 }
@@ skipping 326 matching lines @@
 bool QueryManager::EndQuery(Query* query, base::subtle::Atomic32 submit_count) {
   DCHECK(query);
   if (!RemovePendingQuery(query)) {
     return false;
   }
   return query->End(submit_count);
 }
 
 }  // namespace gles2
 }  // namespace gpu