gpu: guarantee to match pending GBM buffer request to actual GBM handle

content/browser/gpu/gpu_process_host.cc

Index: content/browser/gpu/gpu_process_host.cc
diff --git a/content/browser/gpu/gpu_process_host.cc b/content/browser/gpu/gpu_process_host.cc
index da5a242b7764a04c282ee68345fb08703f7fa3a2..d3c0c5624e24d64400a77a2e7a20de7d79f9b280 100644
--- a/content/browser/gpu/gpu_process_host.cc
+++ b/content/browser/gpu/gpu_process_host.cc
@@ -735,7 +735,9 @@ void GpuProcessHost::CreateGpuMemoryBuffer(
   TRACE_EVENT0("gpu", "GpuProcessHost::CreateGpuMemoryBuffer");
 
   DCHECK(CalledOnValidThread());
-  create_gpu_memory_buffer_requests_.push(callback);
+  DCHECK(create_gpu_memory_buffer_requests_.find(id) ==
+         create_gpu_memory_buffer_requests_.end());
+  create_gpu_memory_buffer_requests_[id] = callback;
   gpu_service_ptr_->CreateGpuMemoryBuffer(
       id, size, format, usage, client_id, surface_handle,
       base::Bind(&GpuProcessHost::OnGpuMemoryBufferCreated,
@@ -792,8 +794,10 @@ void GpuProcessHost::OnGpuMemoryBufferCreated(
   TRACE_EVENT0("gpu", "GpuProcessHost::OnGpuMemoryBufferCreated");
 
   DCHECK(!create_gpu_memory_buffer_requests_.empty());
-  auto callback = create_gpu_memory_buffer_requests_.front();
-  create_gpu_memory_buffer_requests_.pop();
+  DCHECK(create_gpu_memory_buffer_requests_.find(handle.id) !=
+         create_gpu_memory_buffer_requests_.end());

[piman, 2017/05/11 18:04:43]

Actually, because we shouldn't trust the GPU process, we should avoid those
DCHECKs and instead ignore the message if the id isn't in the map.

Note that the condition checked on l.796 is redundant (if the map is empty, this
will fail anyway).

[dshwang, 2017/05/11 20:29:59]

Done.

+  auto callback = create_gpu_memory_buffer_requests_[handle.id];
+  create_gpu_memory_buffer_requests_.erase(handle.id);
   callback.Run(handle, BufferCreationStatus::SUCCESS);
 }
 
@@ -1076,12 +1080,12 @@ void GpuProcessHost::SendOutstandingReplies() {
                  EstablishChannelStatus::GPU_HOST_INVALID);
   }
 
-  while (!create_gpu_memory_buffer_requests_.empty()) {
-    auto callback = create_gpu_memory_buffer_requests_.front();
-    create_gpu_memory_buffer_requests_.pop();
+  for (auto& pair : create_gpu_memory_buffer_requests_) {
+    auto callback = pair.second;
     callback.Run(gfx::GpuMemoryBufferHandle(),
                  BufferCreationStatus::GPU_HOST_INVALID);
   }
+  create_gpu_memory_buffer_requests_.clear();
 
   if (!send_destroying_video_surface_done_cb_.is_null())
     base::ResetAndReturn(&send_destroying_video_surface_done_cb_).Run();