Use CheckedNumerics in AsyncPixelTransfersCompletedQuery, add tests

gpu/command_buffer/service/query_manager.cc

Index: gpu/command_buffer/service/query_manager.cc
diff --git a/gpu/command_buffer/service/query_manager.cc b/gpu/command_buffer/service/query_manager.cc
index 5d5757769f4457a2cac8bd2107b8874ab7c22a36..94f31fa6a2ac930f22461263a5155d19f92bbcfe 100644
--- a/gpu/command_buffer/service/query_manager.cc
+++ b/gpu/command_buffer/service/query_manager.cc
@@ -8,6 +8,7 @@
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/memory/shared_memory.h"
+#include "base/numerics/safe_math.h"
 #include "base/synchronization/lock.h"
 #include "base/time/time.h"
 #include "gpu/command_buffer/common/gles2_cmd_format.h"
@@ -95,8 +96,9 @@ bool AsyncPixelTransfersCompletedQuery::End(
   mem_params.shm_size = buffer.size;
   mem_params.shm_data_offset = shm_offset();
   mem_params.shm_data_size = sizeof(QuerySync);
-  uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size;
-  if (end > mem_params.shm_size || end < mem_params.shm_data_offset)
+  base::CheckedNumeric<uint32> end = mem_params.shm_data_offset;
+  end += mem_params.shm_data_size;
+  if (!end.IsValid() || end.ValueOrDie() > mem_params.shm_size)
     return false;
 
   observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count);
@@ -304,11 +306,17 @@ class AsyncReadPixelsCompletedQuery
  protected:
   void Complete();
   virtual ~AsyncReadPixelsCompletedQuery();
+
+ private:
+  bool completed_;
+  bool complete_result_;
 };
 
 AsyncReadPixelsCompletedQuery::AsyncReadPixelsCompletedQuery(
     QueryManager* manager, GLenum target, int32 shm_id, uint32 shm_offset)
-    : Query(manager, target, shm_id, shm_offset) {
+    : Query(manager, target, shm_id, shm_offset),
+      completed_(false),
+      complete_result_(false) {
 }
 
 bool AsyncReadPixelsCompletedQuery::Begin() {
@@ -323,15 +331,16 @@ bool AsyncReadPixelsCompletedQuery::End(base::subtle::Atomic32 submit_count) {
       base::Bind(&AsyncReadPixelsCompletedQuery::Complete,
                  AsWeakPtr()));
 
-  return true;
+  return Process();
 }
 
 void AsyncReadPixelsCompletedQuery::Complete() {
-  MarkAsCompleted(1);
+  completed_ = true;
+  complete_result_ = MarkAsCompleted(1);
 }
 
 bool AsyncReadPixelsCompletedQuery::Process() {
-  return true;
+  return !completed_ || complete_result_;
 }
 
 void AsyncReadPixelsCompletedQuery::Destroy(bool /* have_context */) {