Allow binding multiple textures to one DC Layer overlay.

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_handlers.cc

 // Copyright (c) 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "gpu/command_buffer/service/gles2_cmd_decoder_passthrough.h"
 
 namespace gpu {
 namespace gles2 {
 
 // Custom Handlers
@@ skipping 1793 matching lines @@
   }
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleScheduleDCLayerCHROMIUM(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::ScheduleDCLayerCHROMIUM& c =
       *static_cast<const volatile gles2::cmds::ScheduleDCLayerCHROMIUM*>(
           cmd_data);
-  const GLfloat* mem = GetSharedMemoryAs<const GLfloat*>(c.shm_id, c.shm_offset,
-                                                         8 * sizeof(GLfloat));
+  unsigned int size;
+  const GLfloat* mem = GetSharedMemoryAndSizeAs<const GLfloat*>(
+      c.shm_id, c.shm_offset, 8 * sizeof(GLfloat), &size);
   if (!mem) {
     return error::kOutOfBounds;
   }
-  GLuint contents_texture_id = static_cast<GLint>(c.contents_texture_id);
+  const GLsizei num_textures = c.num_textures;
+  if (num_textures < 0 || (size - 8 * sizeof(GLfloat)) / sizeof(GLuint) <
+                              static_cast<GLuint>(num_textures)) {
+    return error::kOutOfBounds;
+  }
+  const volatile GLuint* contents_texture_ids =
+      reinterpret_cast<const volatile GLuint*>(mem + 8);
   const GLfloat* contents_rect = mem;
   GLuint background_color = static_cast<GLuint>(c.background_color);
   GLuint edge_aa_mask = static_cast<GLuint>(c.edge_aa_mask);
   const GLfloat* bounds_rect = mem + 4;
-  error::Error error =
-      DoScheduleDCLayerCHROMIUM(contents_texture_id, contents_rect,
-                                background_color, edge_aa_mask, bounds_rect);
+  error::Error error = DoScheduleDCLayerCHROMIUM(
+      num_textures, contents_texture_ids, contents_rect, background_color,
+      edge_aa_mask, bounds_rect);
   if (error != error::kNoError) {
     return error;
   }
   return error::kNoError;
 }
 
 error::Error GLES2DecoderPassthroughImpl::HandleGenPathsCHROMIUM(
     uint32_t immediate_data_size,
     const volatile void* cmd_data) {
   const volatile gles2::cmds::GenPathsCHROMIUM& c =
@@ skipping 879 matching lines @@
         reinterpret_cast<const void*>(static_cast<intptr_t>(data_shm_offset));
   }
 
   return DoCompressedTexSubImage3D(target, level, xoffset, yoffset, zoffset,
                                    width, height, depth, format, image_size,
                                    data_size, data);
 }
 
 }  // namespace gles2
 }  // namespace gpu