GPU: Fix NULL gpu::Buffer dereference.

gpu/command_buffer/client/transfer_buffer.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // A class to Manage a growing transfer buffer.
 
 #include "gpu/command_buffer/client/transfer_buffer.h"
 
 #include "base/debug/trace_event.h"
 #include "base/logging.h"
@@ skipping 49 matching lines @@
     buffer_id_ = -1;
     buffer_ = NULL;
     result_buffer_ = NULL;
     result_shm_offset_ = 0;
     ring_buffer_.reset();
     bytes_since_last_flush_ = 0;
   }
 }
 
 bool TransferBuffer::HaveBuffer() const {
+  DCHECK(buffer_id_ == -1 || buffer_);
   return buffer_id_ != -1;
 }
 
 RingBuffer::Offset TransferBuffer::GetOffset(void* pointer) const {
   return ring_buffer_->GetOffset(pointer);
 }
 
 void TransferBuffer::FreePendingToken(void* p, unsigned int token) {
   ring_buffer_->FreePendingToken(p, token);
   if (bytes_since_last_flush_ >= size_to_flush_ && size_to_flush_ > 0) {
     helper_->Flush();
     bytes_since_last_flush_ = 0;
   }
 }
 
 void TransferBuffer::AllocateRingBuffer(unsigned int size) {
   for (;size >= min_buffer_size_; size /= 2) {
     int32 id = -1;
     scoped_refptr<gpu::Buffer> buffer =
         helper_->command_buffer()->CreateTransferBuffer(size, &id);
     if (id != -1) {
+      DCHECK(buffer);
       buffer_ = buffer;
       ring_buffer_.reset(new AlignedRingBuffer(
           alignment_,
           id,
           result_size_,
           buffer_->size() - result_size_,
           helper_,
           static_cast<char*>(buffer_->memory()) + result_size_));
       buffer_id_ = id;
       result_buffer_ = buffer_->memory();
@@ skipping 120 matching lines @@
   Release();
   // NOTE: we allocate buffers of size 0 so that HaveBuffer will be true, so
   // that address will return a pointer just like malloc, and so that GetShmId
   // will be valid. That has the side effect that we'll insert a token on free.
   // We could add code skip the token for a zero size buffer but it doesn't seem
   // worth the complication.
   buffer_ = transfer_buffer_->AllocUpTo(new_size, &size_);
 }
 
 }  // namespace gpu