GPU: Fix NULL gpu::Buffer dereference.

content/renderer/pepper/ppb_graphics_3d_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/pepper/ppb_graphics_3d_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/message_loop/message_loop.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 20 matching lines @@
 using blink::WebFrame;
 using blink::WebPluginContainer;
 using blink::WebString;
 
 namespace content {
 
 namespace {
 const int32 kCommandBufferSize = 1024 * 1024;
 const int32 kTransferBufferSize = 1024 * 1024;
 
-PP_Bool ShmToHandle(base::SharedMemory* shm,
-                    size_t size,
+PP_Bool BufferToHandle(scoped_refptr<gpu::Buffer> buffer,
                     int* shm_handle,
                     uint32_t* shm_size) {
-  if (!shm || !shm_handle || !shm_size)
+  if (!buffer || !shm_handle || !shm_size)
     return PP_FALSE;
 #if defined(OS_POSIX)
-  *shm_handle = shm->handle().fd;
+  *shm_handle = buffer->shared_memory()->handle().fd;
 #elif defined(OS_WIN)
-  *shm_handle = reinterpret_cast<int>(shm->handle());
+  *shm_handle = reinterpret_cast<int>(buffer->shared_memory()->handle());
 #else
   #error "Platform not supported."
 #endif
-  *shm_size = size;
+  *shm_size = buffer->size();
   return PP_TRUE;
 }
 
 }  // namespace.
 
 PPB_Graphics3D_Impl::PPB_Graphics3D_Impl(PP_Instance instance)
     : PPB_Graphics3D_Shared(instance),
       bound_to_instance_(false),
       commit_pending_(false),
       weak_ptr_factory_(this) {
@@ skipping 56 matching lines @@
 
 PP_Bool PPB_Graphics3D_Impl::DestroyTransferBuffer(int32_t id) {
   GetCommandBuffer()->DestroyTransferBuffer(id);
   return PP_TRUE;
 }
 
 PP_Bool PPB_Graphics3D_Impl::GetTransferBuffer(int32_t id,
                                                int* shm_handle,
                                                uint32_t* shm_size) {
   scoped_refptr<gpu::Buffer> buffer = GetCommandBuffer()->GetTransferBuffer(id);
-  return ShmToHandle(
-      buffer->shared_memory(), buffer->size(), shm_handle, shm_size);
+  return BufferToHandle(buffer, shm_handle, shm_size);
 }
 
 PP_Bool PPB_Graphics3D_Impl::Flush(int32_t put_offset) {
   GetCommandBuffer()->Flush(put_offset);
   return PP_TRUE;
 }
 
 gpu::CommandBuffer::State PPB_Graphics3D_Impl::WaitForTokenInRange(
     int32_t start,
     int32_t end) {
@@ skipping 192 matching lines @@
               PPP_GRAPHICS_3D_INTERFACE));
   // We have to check *again* that the instance exists, because it could have
   // been deleted during GetPluginInterface(). Even the PluginModule could be
   // deleted, but in that case, the instance should also be gone, so the
   // GetInstance check covers both cases.
   if (ppp_graphics_3d && HostGlobals::Get()->GetInstance(this_pp_instance))
     ppp_graphics_3d->Graphics3DContextLost(this_pp_instance);
 }
 
 }  // namespace content