gpu: guarantee to match pending GBM buffer request to actual GBM handle

content/browser/gpu/gpu_process_host.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/gpu/gpu_process_host.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <list>
@@ skipping 717 matching lines @@
     gfx::GpuMemoryBufferId id,
     const gfx::Size& size,
     gfx::BufferFormat format,
     gfx::BufferUsage usage,
     int client_id,
     gpu::SurfaceHandle surface_handle,
     const CreateGpuMemoryBufferCallback& callback) {
   TRACE_EVENT0("gpu", "GpuProcessHost::CreateGpuMemoryBuffer");
 
   DCHECK(CalledOnValidThread());
-  create_gpu_memory_buffer_requests_.push(callback);
+  DCHECK(create_gpu_memory_buffer_requests_.find(id) ==
+         create_gpu_memory_buffer_requests_.end());
+  create_gpu_memory_buffer_requests_[id] = callback;
   gpu_service_ptr_->CreateGpuMemoryBuffer(
       id, size, format, usage, client_id, surface_handle,
       base::Bind(&GpuProcessHost::OnGpuMemoryBufferCreated,
                  weak_ptr_factory_.GetWeakPtr()));
 }
 
 void GpuProcessHost::DestroyGpuMemoryBuffer(gfx::GpuMemoryBufferId id,
                                             int client_id,
                                             const gpu::SyncToken& sync_token) {
   TRACE_EVENT0("gpu", "GpuProcessHost::DestroyGpuMemoryBuffer");
@@ skipping 36 matching lines @@
 
   callback.Run(IPC::ChannelHandle(channel_handle.release()), gpu_info_,
                EstablishChannelStatus::SUCCESS);
 }
 
 void GpuProcessHost::OnGpuMemoryBufferCreated(
     const gfx::GpuMemoryBufferHandle& handle) {
   TRACE_EVENT0("gpu", "GpuProcessHost::OnGpuMemoryBufferCreated");
 
   DCHECK(!create_gpu_memory_buffer_requests_.empty());
-  auto callback = create_gpu_memory_buffer_requests_.front();
-  create_gpu_memory_buffer_requests_.pop();
+  DCHECK(create_gpu_memory_buffer_requests_.find(handle.id) !=
+         create_gpu_memory_buffer_requests_.end());

[piman, 2017/05/11 18:04:43]

Actually, because we shouldn't trust the GPU process, we should avoid those
DCHECKs and instead ignore the message if the id isn't in the map.

Note that the condition checked on l.796 is redundant (if the map is empty, this
will fail anyway).

[dshwang, 2017/05/11 20:29:59]

Done.

+  auto callback = create_gpu_memory_buffer_requests_[handle.id];
+  create_gpu_memory_buffer_requests_.erase(handle.id);
   callback.Run(handle, BufferCreationStatus::SUCCESS);
 }
 
 #if defined(OS_ANDROID)
 void GpuProcessHost::OnDestroyingVideoSurfaceAck() {
   TRACE_EVENT0("gpu", "GpuProcessHost::OnDestroyingVideoSurfaceAck");
   if (!send_destroying_video_surface_done_cb_.is_null())
     base::ResetAndReturn(&send_destroying_video_surface_done_cb_).Run();
 }
 #endif
@@ skipping 262 matching lines @@
   valid_ = false;
 
   // First send empty channel handles for all EstablishChannel requests.
   while (!channel_requests_.empty()) {
     auto callback = channel_requests_.front();
     channel_requests_.pop();
     callback.Run(IPC::ChannelHandle(), gpu::GPUInfo(),
                  EstablishChannelStatus::GPU_HOST_INVALID);
   }
 
-  while (!create_gpu_memory_buffer_requests_.empty()) {
-    auto callback = create_gpu_memory_buffer_requests_.front();
-    create_gpu_memory_buffer_requests_.pop();
+  for (auto& pair : create_gpu_memory_buffer_requests_) {
+    auto callback = pair.second;
     callback.Run(gfx::GpuMemoryBufferHandle(),
                  BufferCreationStatus::GPU_HOST_INVALID);
   }
+  create_gpu_memory_buffer_requests_.clear();
 
   if (!send_destroying_video_surface_done_cb_.is_null())
     base::ResetAndReturn(&send_destroying_video_surface_done_cb_).Run();
 }
 
 void GpuProcessHost::BlockLiveOffscreenContexts() {
   for (std::multiset<GURL>::iterator iter =
            urls_with_live_offscreen_contexts_.begin();
        iter != urls_with_live_offscreen_contexts_.end(); ++iter) {
     GpuDataManagerImpl::GetInstance()->BlockDomainFrom3DAPIs(
@@ skipping 111 matching lines @@
   if (!cache.get())
     return;
 
   cache->set_shader_loaded_callback(base::Bind(&GpuProcessHost::LoadedShader,
                                                weak_ptr_factory_.GetWeakPtr()));
 
   client_id_to_shader_cache_[client_id] = cache;
 }
 
 }  // namespace content