OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "gpu/command_buffer/service/query_manager.h" | 5 #include "gpu/command_buffer/service/query_manager.h" |
6 | 6 |
7 #include "base/atomicops.h" | 7 #include "base/atomicops.h" |
8 #include "base/bind.h" | 8 #include "base/bind.h" |
9 #include "base/logging.h" | 9 #include "base/logging.h" |
10 #include "base/memory/shared_memory.h" | 10 #include "base/memory/shared_memory.h" |
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
91 AsyncMemoryParams mem_params; | 91 AsyncMemoryParams mem_params; |
92 // Get the real shared memory since it might need to be duped to prevent | 92 // Get the real shared memory since it might need to be duped to prevent |
93 // use-after-free of the memory. | 93 // use-after-free of the memory. |
94 Buffer buffer = manager()->decoder()->GetSharedMemoryBuffer(shm_id()); | 94 Buffer buffer = manager()->decoder()->GetSharedMemoryBuffer(shm_id()); |
95 if (!buffer.shared_memory) | 95 if (!buffer.shared_memory) |
96 return false; | 96 return false; |
97 mem_params.shared_memory = buffer.shared_memory; | 97 mem_params.shared_memory = buffer.shared_memory; |
98 mem_params.shm_size = buffer.size; | 98 mem_params.shm_size = buffer.size; |
99 mem_params.shm_data_offset = shm_offset(); | 99 mem_params.shm_data_offset = shm_offset(); |
100 mem_params.shm_data_size = sizeof(QuerySync); | 100 mem_params.shm_data_size = sizeof(QuerySync); |
| 101 uint32 end = mem_params.shm_data_offset + mem_params.shm_data_size; |
| 102 if (end > mem_params.shm_size || end < mem_params.shm_data_offset) |
| 103 return false; |
101 | 104 |
102 observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count); | 105 observer_ = new AsyncPixelTransferCompletionObserverImpl(submit_count); |
103 | 106 |
104 // Ask AsyncPixelTransferDelegate to run completion callback after all | 107 // Ask AsyncPixelTransferDelegate to run completion callback after all |
105 // previous async transfers are done. No guarantee that callback is run | 108 // previous async transfers are done. No guarantee that callback is run |
106 // on the current thread. | 109 // on the current thread. |
107 manager()->decoder()->GetAsyncPixelTransferManager() | 110 manager()->decoder()->GetAsyncPixelTransferManager() |
108 ->AsyncNotifyCompletion(mem_params, observer_); | 111 ->AsyncNotifyCompletion(mem_params, observer_); |
109 | 112 |
110 return AddToPendingTransferQueue(submit_count); | 113 return AddToPendingTransferQueue(submit_count); |
(...skipping 560 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
671 bool QueryManager::EndQuery(Query* query, uint32 submit_count) { | 674 bool QueryManager::EndQuery(Query* query, uint32 submit_count) { |
672 DCHECK(query); | 675 DCHECK(query); |
673 if (!RemovePendingQuery(query)) { | 676 if (!RemovePendingQuery(query)) { |
674 return false; | 677 return false; |
675 } | 678 } |
676 return query->End(submit_count); | 679 return query->End(submit_count); |
677 } | 680 } |
678 | 681 |
679 } // namespace gles2 | 682 } // namespace gles2 |
680 } // namespace gpu | 683 } // namespace gpu |
OLD | NEW |