Make sure buffers are large enough to hold the Result structure.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h"
 
 namespace gpu {
 namespace gles2 {
 
 // Custom Handlers
@@ skipping 208 matching lines @@
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetActiveUniformBlockiv& c =
       *static_cast<const volatile gles2::cmds::GetActiveUniformBlockiv*>(
           cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLuint uniformBlockIndex = static_cast<GLuint>(c.index);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetActiveUniformBlockiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.params_shm_id, c.params_shm_offset, &buffer_size);
+      c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error = DoGetActiveUniformBlockiv(
       program, uniformBlockIndex, pname, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
@@ skipping 199 matching lines @@
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetInternalformativ& c =
       *static_cast<const volatile gles2::cmds::GetInternalformativ*>(cmd_data);
   GLenum target = static_cast<GLenum>(c.target);
   GLenum internalformat = static_cast<GLenum>(c.format);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetInternalformativ::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.params_shm_id, c.params_shm_offset, &buffer_size);
+      c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error = DoGetInternalformativ(target, internalformat, pname,
                                              bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
@@ skipping 188 matching lines @@
 error::Error GLES2DecoderPassthroughImpl::HandleGetUniformfv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformfv& c =
       *static_cast<const volatile gles2::cmds::GetUniformfv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformfv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.params_shm_id, c.params_shm_offset, &buffer_size);
+      c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
   GLfloat* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformfv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
   result->SetNumResults(length);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleGetUniformiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformiv& c =
       *static_cast<const volatile gles2::cmds::GetUniformiv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.params_shm_id, c.params_shm_offset, &buffer_size);
+      c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
   GLint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformiv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
   }
   if (length > bufsize) {
     return error::kOutOfBounds;
   }
   result->SetNumResults(length);
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleGetUniformuiv(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetUniformuiv& c =
       *static_cast<const volatile gles2::cmds::GetUniformuiv*>(cmd_data);
   GLuint program = static_cast<GLuint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   unsigned int buffer_size = 0;
   typedef cmds::GetUniformuiv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.params_shm_id, c.params_shm_offset, &buffer_size);
+      c.params_shm_id, c.params_shm_offset, sizeof(Result), &buffer_size);
   GLuint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetUniformuiv(program, location, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
@@ skipping 80 matching lines @@
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GetVertexAttribPointerv& c =
       *static_cast<const volatile gles2::cmds::GetVertexAttribPointerv*>(
           cmd_data);
   GLuint index = static_cast<GLuint>(c.index);
   GLenum pname = static_cast<GLenum>(c.pname);
   unsigned int buffer_size = 0;
   typedef cmds::GetVertexAttribPointerv::Result Result;
   Result* result = GetSharedMemoryAndSizeAs<Result*>(
-      c.pointer_shm_id, c.pointer_shm_offset, &buffer_size);
+      c.pointer_shm_id, c.pointer_shm_offset, sizeof(Result), &buffer_size);
   GLuint* params = result ? result->GetData() : NULL;
   if (params == NULL) {
     return error::kOutOfBounds;
   }
   GLsizei bufsize = Result::ComputeMaxResults(buffer_size);
   GLsizei length = 0;
   error::Error error =
       DoGetVertexAttribPointerv(index, pname, bufsize, &length, params);
   if (error != error::kNoError) {
     return error;
@@ skipping 28 matching lines @@
   GLint y = static_cast<GLint>(c.y);
   GLsizei width = static_cast<GLsizei>(c.width);
   GLsizei height = static_cast<GLsizei>(c.height);
   GLenum format = static_cast<GLenum>(c.format);
   GLenum type = static_cast<GLenum>(c.type);
 
   uint8_t* pixels = nullptr;
   unsigned int buffer_size = 0;
   if (c.pixels_shm_id != 0) {
     pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        c.pixels_shm_id, c.pixels_shm_offset, &buffer_size);
+        c.pixels_shm_id, c.pixels_shm_offset, 0, &buffer_size);
     if (!pixels) {
       return error::kOutOfBounds;
     }
   }
 
   GLsizei bufsize = buffer_size;
   GLsizei length = 0;
   int32_t success = 0;
   error::Error error = DoReadPixels(x, y, width, height, format, type, bufsize,
                                     &length, pixels, &success);
@@ skipping 68 matching lines @@
   GLenum format = static_cast<GLenum>(c.format);
   GLenum type = static_cast<GLenum>(c.type);
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
   unsigned int buffer_size = 0;
   const void* pixels = nullptr;
 
   if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
     pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, &buffer_size);
+        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
     if (!pixels) {
       return error::kOutOfBounds;
     }
   }
 
   error::Error error =
       DoTexImage2D(target, level, internal_format, width, height, border,
                    format, type, buffer_size, pixels);
   if (error != error::kNoError) {
     return error;
@@ skipping 17 matching lines @@
   GLenum format = static_cast<GLenum>(c.format);
   GLenum type = static_cast<GLenum>(c.type);
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
   unsigned int buffer_size = 0;
   const void* pixels = nullptr;
 
   if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
     pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, &buffer_size);
+        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
     if (!pixels) {
       return error::kOutOfBounds;
     }
   }
 
   error::Error error =
       DoTexImage3D(target, level, internal_format, width, height, depth, border,
                    format, type, buffer_size, pixels);
   if (error != error::kNoError) {
     return error;
@@ skipping 16 matching lines @@
   GLenum format = static_cast<GLenum>(c.format);
   GLenum type = static_cast<GLenum>(c.type);
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
   unsigned int buffer_size = 0;
   const void* pixels = nullptr;
 
   if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
     pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, &buffer_size);
+        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
     if (!pixels) {
       return error::kOutOfBounds;
     }
   }
 
   error::Error error =
       DoTexSubImage2D(target, level, xoffset, yoffset, width, height, format,
                       type, buffer_size, pixels);
   if (error != error::kNoError) {
     return error;
@@ skipping 18 matching lines @@
   GLenum format = static_cast<GLenum>(c.format);
   GLenum type = static_cast<GLenum>(c.type);
   uint32_t pixels_shm_id = c.pixels_shm_id;
   uint32_t pixels_shm_offset = c.pixels_shm_offset;
 
   unsigned int buffer_size = 0;
   const void* pixels = nullptr;
 
   if (pixels_shm_id != 0 || pixels_shm_offset != 0) {
     pixels = GetSharedMemoryAndSizeAs<uint8_t*>(
-        pixels_shm_id, pixels_shm_offset, &buffer_size);
+        pixels_shm_id, pixels_shm_offset, 0, &buffer_size);
     if (!pixels) {
       return error::kOutOfBounds;
     }
   }
 
   error::Error error =
       DoTexSubImage3D(target, level, xoffset, yoffset, zoffset, width, height,
                       depth, format, type, buffer_size, pixels);
   if (error != error::kNoError) {
     return error;
@@ skipping 816 matching lines @@
   GLsizei num_coords = static_cast<GLsizei>(c.numCoords);
   GLenum coord_type = static_cast<GLenum>(c.coordType);
   const GLvoid* coords = nullptr;
   GLsizei coords_bufsize = 0;
   if (num_coords > 0) {
     uint32_t coords_shm_id = static_cast<uint32_t>(c.coords_shm_id);
     uint32_t coords_shm_offset = static_cast<uint32_t>(c.coords_shm_offset);
     if (coords_shm_id != 0 || coords_shm_offset != 0) {
       unsigned int memory_size = 0;
       coords = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          coords_shm_id, coords_shm_offset, &memory_size);
+          coords_shm_id, coords_shm_offset, 0, &memory_size);
       coords_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!coords) {
       return error::kOutOfBounds;
     }
   }
 
   error::Error error =
       DoPathCommandsCHROMIUM(path, num_commands, commands, num_coords,
@@ skipping 150 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLenum fill_mode = static_cast<GLenum>(c.fillMode);
   GLuint mask = static_cast<GLuint>(c.mask);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoStencilFillPathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, fill_mode,
       mask, transform_type, transform_values, transform_values_bufsize);
   if (error != error::kNoError) {
@@ skipping 14 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLint reference = static_cast<GLint>(c.reference);
   GLuint mask = static_cast<GLuint>(c.mask);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoStencilStrokePathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, reference,
       mask, transform_type, transform_values, transform_values_bufsize);
   if (error != error::kNoError) {
@@ skipping 12 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLenum cover_mode = static_cast<GLenum>(c.coverMode);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoCoverFillPathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, cover_mode,
       transform_type, transform_values, transform_values_bufsize);
   if (error != error::kNoError) {
@@ skipping 14 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLenum cover_mode = static_cast<GLenum>(c.coverMode);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoCoverStrokePathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, cover_mode,
       transform_type, transform_values, transform_values_bufsize);
   if (error != error::kNoError) {
@@ skipping 13 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLenum cover_mode = static_cast<GLenum>(c.coverMode);
   GLenum fill_mode = static_cast<GLenum>(c.fillMode);
   GLuint mask = static_cast<GLuint>(c.mask);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoStencilThenCoverFillPathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, cover_mode,
       fill_mode, mask, transform_type, transform_values,
       transform_values_bufsize);
@@ skipping 14 matching lines @@
   GLsizei num_paths = static_cast<GLsizei>(c.numPaths);
   GLenum path_name_type = static_cast<GLuint>(c.pathNameType);
   const GLvoid* paths = nullptr;
   GLsizei paths_bufsize = 0;
   if (num_paths > 0) {
     uint32_t paths_shm_id = static_cast<uint32_t>(c.paths_shm_id);
     uint32_t paths_shm_offset = static_cast<uint32_t>(c.paths_shm_offset);
     if (paths_shm_id != 0 || paths_shm_offset != 0) {
       unsigned int memory_size = 0;
       paths = GetSharedMemoryAndSizeAs<const GLvoid*>(
-          paths_shm_id, paths_shm_offset, &memory_size);
+          paths_shm_id, paths_shm_offset, 0, &memory_size);
       paths_bufsize = static_cast<GLsizei>(memory_size);
     }
 
     if (!paths) {
       return error::kOutOfBounds;
     }
   }
   GLuint path_base = static_cast<GLuint>(c.pathBase);
   GLenum cover_mode = static_cast<GLenum>(c.coverMode);
   GLint reference = static_cast<GLint>(c.reference);
   GLuint mask = static_cast<GLuint>(c.mask);
   GLenum transform_type = static_cast<GLuint>(c.transformType);
   const GLfloat* transform_values = nullptr;
   GLsizei transform_values_bufsize = 0;
   if (c.transformValues_shm_id != 0 || c.transformValues_shm_offset != 0) {
     unsigned int memory_size = 0;
     transform_values = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.transformValues_shm_id, c.transformValues_shm_offset, &memory_size);
+        c.transformValues_shm_id, c.transformValues_shm_offset, 0,
+        &memory_size);
     transform_values_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!transform_values) {
     return error::kOutOfBounds;
   }
 
   error::Error error = DoStencilThenCoverStrokePathInstancedCHROMIUM(
       num_paths, path_name_type, paths, paths_bufsize, path_base, cover_mode,
       reference, mask, transform_type, transform_values,
       transform_values_bufsize);
@@ skipping 40 matching lines @@
           cmd_data);
   GLint program = static_cast<GLint>(c.program);
   GLint location = static_cast<GLint>(c.location);
   GLenum gen_mode = static_cast<GLint>(c.genMode);
   GLint components = static_cast<GLint>(c.components);
   const GLfloat* coeffs = nullptr;
   GLsizei coeffs_bufsize = 0;
   if (c.coeffs_shm_id != 0 || c.coeffs_shm_offset != 0) {
     unsigned int memory_size = 0;
     coeffs = GetSharedMemoryAndSizeAs<const GLfloat*>(
-        c.coeffs_shm_id, c.coeffs_shm_offset, &memory_size);
+        c.coeffs_shm_id, c.coeffs_shm_offset, 0, &memory_size);
     coeffs_bufsize = static_cast<GLsizei>(memory_size);
   }
   if (!coeffs) {
     return error::kOutOfBounds;
   }
   error::Error error = DoProgramPathFragmentInputGenCHROMIUM(
       program, location, gen_mode, components, coeffs, coeffs_bufsize);
   if (error != error::kNoError) {
     return error;
   }
@@ skipping 250 matching lines @@
   // TODO(geofflang): Handle PIXEL_UNPACK_BUFFER case.
   const void* data = GetSharedMemoryAs<const void*>(
       c.data_shm_id, c.data_shm_offset, image_size);
   return DoCompressedTexSubImage3D(
       target, level, xoffset, yoffset, zoffset, width, height, depth,
       format, image_size, data);
 }
 
 }  // namespace gles2
 }  // namespace gpu