[BlobAsync] Fixed shared memory mapping

content/child/blob_storage/blob_transport_controller.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/child/blob_storage/blob_transport_controller.h"
 
 #include <utility>
 #include <vector>
 
 #include "base/lazy_instance.h"
@@ skipping 204 matching lines @@
     const std::vector<IPC::PlatformFileForTransit>& file_handles,
     std::vector<BlobItemBytesResponse>* out) {
   DCHECK(out->empty());
   auto it = blob_storage_.find(uuid);
   if (it == blob_storage_.end())
     return ResponsesStatus::BLOB_NOT_FOUND;
 
   BlobConsolidation* consolidation = it->second.get();
   const auto& consolidated_items = consolidation->consolidated_items();
 
+  // We need to calculate how much memory we expect to be writing to the memory
+  // segments so we can correctly map it the first time.
+  std::vector<size_t> shared_memory_sizes(memory_handles->size());
+  for (const BlobItemBytesRequest& request : requests) {
+    if (request.transport_strategy !=
+        IPCBlobItemRequestStrategy::SHARED_MEMORY) {
+      continue;
+    }
+    DCHECK_LT(request.handle_index, memory_handles->size())
+        << "Invalid handle index.";
+    shared_memory_sizes[request.handle_index] =
+        std::max<size_t>(shared_memory_sizes[request.handle_index],
+                         request.size + request.handle_offset);
+  }
+
   // Since we can be writing to the same shared memory handle from multiple
   // requests, we keep them in a vector and lazily create them.
   ScopedVector<SharedMemory> opened_memory;
   opened_memory.resize(memory_handles->size());
   for (const BlobItemBytesRequest& request : requests) {
     DCHECK_LT(request.renderer_item_index, consolidated_items.size())
         << "Invalid item index";
 
     const ConsolidatedItem& item =
         consolidated_items[request.renderer_item_index];
@@ skipping 12 matching lines @@
             << "Error reading from consolidated blob: "
             << static_cast<int>(status);
         break;
       }
       case IPCBlobItemRequestStrategy::SHARED_MEMORY: {
         DCHECK_LT(request.handle_index, memory_handles->size())
             << "Invalid handle index.";
         SharedMemory* memory = opened_memory[request.handle_index];
         if (!memory) {
           SharedMemoryHandle& handle = (*memory_handles)[request.handle_index];
+          size_t size = shared_memory_sizes[request.handle_index];
           DCHECK(SharedMemory::IsHandleValid(handle));
           std::unique_ptr<SharedMemory> shared_memory(
               new SharedMemory(handle, false));
-          if (!shared_memory->Map(request.size))
+          if (!shared_memory->Map(size))
             return ResponsesStatus::SHARED_MEMORY_MAP_FAILED;
           memory = shared_memory.get();
           opened_memory[request.handle_index] = shared_memory.release();
         }
         CHECK(memory->memory()) << "Couldn't map memory for blob transfer.";
         ReadStatus status = consolidation->ReadMemory(
             request.renderer_item_index, request.renderer_item_offset,
             request.size,
             static_cast<char*>(memory->memory()) + request.handle_offset);
         DCHECK(status == ReadStatus::OK)
@@ skipping 14 matching lines @@
 
 void BlobTransportController::ReleaseBlobConsolidation(
     const std::string& uuid) {
   if (blob_storage_.erase(uuid)) {
     main_thread_runner_->PostTask(FROM_HERE,
                                   base::Bind(&DecChildProcessRefCount));
   }
 }
 
 }  // namespace content