[BlobAsync] Fixed shared memory mapping

content/child/blob_storage/blob_transport_controller.cc

Index: content/child/blob_storage/blob_transport_controller.cc
diff --git a/content/child/blob_storage/blob_transport_controller.cc b/content/child/blob_storage/blob_transport_controller.cc
index 1c817aa52f9c17549a8f4bd54fc95638abde5e89..36ae861fe4f9d193657ef6bf1717671c3834c938 100644
--- a/content/child/blob_storage/blob_transport_controller.cc
+++ b/content/child/blob_storage/blob_transport_controller.cc
@@ -211,6 +211,21 @@ void BlobTransportController::OnMemoryRequest(
   // requests, we keep them in a vector and lazily create them.
   ScopedVector<SharedMemory> opened_memory;
   opened_memory.resize(memory_handles->size());
+
+  // We need to calculate how much memory we expect to be writing to the memory
+  // segments so we can correctly map it the first time.
+  std::vector<size_t> shared_memory_sizes;

[Marijn Kruisselbrink, 2016/06/21 16:52:35]

nit: Why not just pass memory_handles->size() directly to the vector
constructor, rather than the split between constructing and resizing?

[dmurph, 2016/06/21 17:33:03]

Ah, right, thanks.

+  shared_memory_sizes.resize(memory_handles->size(), 0);
+  for (const BlobItemBytesRequest& request : requests) {
+    if (request.transport_strategy !=
+        IPCBlobItemRequestStrategy::SHARED_MEMORY) {
+      continue;
+    }
+    shared_memory_sizes[request.handle_index] =
+        std::max(shared_memory_sizes[request.handle_index],
+                 static_cast<size_t>(request.size + request.handle_offset));

[Marijn Kruisselbrink, 2016/06/21 16:52:35]

rather than the static_cast<size_t> you could also just explicitly pass the
template parameter to std::max (so std::max<size_t>(..., ...))

[dmurph, 2016/06/21 17:33:03]

Done.

+  }
+
   for (const BlobItemBytesRequest& request : requests) {
     DCHECK_LT(request.renderer_item_index, consolidated_items.size())
         << "Invalid item index";
@@ -240,11 +255,12 @@ void BlobTransportController::OnMemoryRequest(
         SharedMemory* memory = opened_memory[request.handle_index];
         if (!memory) {
           SharedMemoryHandle& handle = (*memory_handles)[request.handle_index];
+          size_t size = shared_memory_sizes[request.handle_index];
           DCHECK(SharedMemory::IsHandleValid(handle));
           std::unique_ptr<SharedMemory> shared_memory(
               new SharedMemory(handle, false));
 
-          if (!shared_memory->Map(request.size)) {
+          if (!shared_memory->Map(size)) {
             // This would happen if the renderer process doesn't have enough
             // memory to map the shared memory, which is possible if we don't
             // have much memory. If this scenario happens often, we could delay