Change CHROMIUM_image declarations to support multi planar input.

content/common/gpu/gpu_command_buffer_stub.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
 #include "base/hash.h"
 #include "base/json/json_writer.h"
 #include "base/memory/shared_memory.h"
@@ skipping 922 matching lines @@
   if (has_callback) {
     if (!memory_manager_client_state_) {
       memory_manager_client_state_.reset(GetMemoryManager()->CreateClientState(
           this, surface_id_ != 0, true));
     }
   } else {
     memory_manager_client_state_.reset();
   }
 }
 
-void GpuCommandBufferStub::OnCreateImage(int32 id,
-                                         gfx::GpuMemoryBufferHandle handle,
-                                         gfx::Size size,
-                                         gfx::GpuMemoryBuffer::Format format,
-                                         uint32 internalformat) {
+void GpuCommandBufferStub::OnCreateImage(
+    int32 id,
+    std::vector<gfx::GpuMemoryBufferHandle> handles,
+    gfx::Size size,
+    std::vector<gfx::GpuMemoryBuffer::Format> formats,
+    uint32 internalformat) {
   TRACE_EVENT0("gpu", "GpuCommandBufferStub::OnCreateImage");
 
   if (!decoder_)
     return;
 
   gpu::gles2::ImageManager* image_manager = decoder_->GetImageManager();
   DCHECK(image_manager);
   if (image_manager->LookupImage(id)) {
     LOG(ERROR) << "Image already exists with same ID.";
     return;
   }
 
-  if (!gpu::ImageFactory::IsGpuMemoryBufferFormatSupported(
-          format, decoder_->GetCapabilities())) {
-    LOG(ERROR) << "Format is not supported.";
-    return;
+  int num_buffers =
+      gpu::ImageFactory::GpuMemoryBufferCountForImageFormat(internalformat);
+  CHECK_EQ(static_cast<int>(handles.size()), num_buffers);

[reveman, 2015/03/10 04:27:21]

CHECKS here makes it possible for a malicious renderer to crash the GPU process.
That's a security issue that we never want to allow. Log an error and return
instead.

[emircan, 2015/03/11 18:36:35]

Done.

+  CHECK_EQ(static_cast<int>(formats.size()), num_buffers);
+
+  for (int i = 0; i < num_buffers; ++i) {
+    const gfx::GpuMemoryBuffer::Format& format = formats[i];
+    if (!gpu::ImageFactory::IsGpuMemoryBufferFormatSupported(
+            format, decoder_->GetCapabilities())) {
+      LOG(ERROR) << "Format is not supported.";
+      return;
+    }
+    if (!gpu::ImageFactory::IsImageSizeValidForGpuMemoryBufferFormat(
+            size, format)) {
+      LOG(ERROR) << "Invalid image size for format.";
+      return;
+    }
+    if (!gpu::ImageFactory::IsImageFormatCompatibleWithGpuMemoryBufferFormat(
+            internalformat, i, format)) {
+      LOG(ERROR) << "Incompatible image format.";
+      return;
+    }
   }
 
-  if (!gpu::ImageFactory::IsImageSizeValidForGpuMemoryBufferFormat(size,
-                                                                   format)) {
-    LOG(ERROR) << "Invalid image size for format.";
-    return;
-  }
-
-  if (!gpu::ImageFactory::IsImageFormatCompatibleWithGpuMemoryBufferFormat(
-          internalformat, format)) {
-    LOG(ERROR) << "Incompatible image format.";
-    return;
-  }
-
-  scoped_refptr<gfx::GLImage> image = channel()->CreateImageForGpuMemoryBuffer(
-      handle, size, format, internalformat);
+  scoped_refptr<gfx::GLImage> image = channel()->CreateImageForGpuMemoryBuffers(
+      handles, size, formats, internalformat);
   if (!image.get())
     return;
 
   image_manager->AddImage(image.get(), id);
 }
 
 void GpuCommandBufferStub::OnDestroyImage(int32 id) {
   TRACE_EVENT0("gpu", "GpuCommandBufferStub::OnDestroyImage");
 
   if (!decoder_)
@@ skipping 112 matching lines @@
   Send(new GpuCommandBufferMsg_SwapBuffersCompleted(route_id_, latency_info));
 }
 
 void GpuCommandBufferStub::SendUpdateVSyncParameters(base::TimeTicks timebase,
                                                      base::TimeDelta interval) {
   Send(new GpuCommandBufferMsg_UpdateVSyncParameters(route_id_, timebase,
                                                      interval));
 }
 
 }  // namespace content