Apply merge from @fsamuel.

content/renderer/browser_plugin/browser_plugin.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/browser_plugin/browser_plugin.h"
 
 #include "base/json/json_string_value_serializer.h"
 #include "base/message_loop.h"
 #include "base/string_number_conversions.h"
 #include "base/string_util.h"
@@ skipping 88 matching lines @@
 
 BrowserPlugin::BrowserPlugin(
     int instance_id,
     RenderViewImpl* render_view,
     WebKit::WebFrame* frame,
     const WebPluginParams& params)
     : instance_id_(instance_id),
       render_view_(render_view->AsWeakPtr()),
       render_view_routing_id_(render_view->GetRoutingID()),
       container_(NULL),
-      current_damage_buffer_(NULL),
-      pending_damage_buffer_(NULL),
+      damage_buffer_sequence_id_(0),
       sad_guest_(NULL),
       guest_crashed_(false),
       navigate_src_sent_(false),
       auto_size_(false),
       max_height_(0),
       max_width_(0),
       min_height_(0),
       min_width_(0),
       process_id_(-1),
       persist_storage_(false),
       valid_partition_id_(true),
       content_window_routing_id_(MSG_ROUTING_NONE),
       plugin_focused_(false),
       embedder_focused_(false),
       visible_(true),
       size_changed_in_flight_(false),
       browser_plugin_manager_(render_view->browser_plugin_manager()),
       current_nav_entry_index_(0),
       nav_entry_count_(0) {
   browser_plugin_manager()->AddBrowserPlugin(instance_id, this);
   bindings_.reset(new BrowserPluginBindings(this));
 
   ParseAttributes(params);
 }
 
 BrowserPlugin::~BrowserPlugin() {
-  if (current_damage_buffer_)
-    FreeDamageBuffer(&current_damage_buffer_);
-  if (pending_damage_buffer_)
-    FreeDamageBuffer(&pending_damage_buffer_);
+  current_damage_buffer_.reset();
+  pending_damage_buffer_.reset();
   browser_plugin_manager()->RemoveBrowserPlugin(instance_id_);
   browser_plugin_manager()->Send(
       new BrowserPluginHostMsg_PluginDestroyed(
           render_view_routing_id_,
           instance_id_));
 }
 
 void BrowserPlugin::Cleanup() {
-  if (current_damage_buffer_)
-    FreeDamageBuffer(&current_damage_buffer_);
-  if (pending_damage_buffer_)
-    FreeDamageBuffer(&pending_damage_buffer_);
+  current_damage_buffer_.reset();
+  pending_damage_buffer_.reset();
 }
 
 bool BrowserPlugin::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(BrowserPlugin, message)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_AdvanceFocus, OnAdvanceFocus)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_GuestContentWindowReady,
                         OnGuestContentWindowReady)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_GuestGone, OnGuestGone)
     IPC_MESSAGE_HANDLER(BrowserPluginMsg_GuestResponsive, OnGuestResponsive)
@@ skipping 46 matching lines @@
 
   // If we haven't created the guest yet, do so now. We will navigate it right
   // after creation. If |src| is empty, we can delay the creation until we
   // acutally need it.
   if (!navigate_src_sent_) {
     BrowserPluginHostMsg_CreateGuest_Params create_guest_params;
     create_guest_params.storage_partition_id = storage_partition_id_;
     create_guest_params.persist_storage = persist_storage_;
     create_guest_params.focused = ShouldGuestBeFocused();
     create_guest_params.visible = visible_;
-    pending_damage_buffer_ =
-        GetDamageBufferWithSizeParams(&create_guest_params.auto_size_params,
-                                      &create_guest_params.resize_guest_params);
+    GetDamageBufferWithSizeParams(&create_guest_params.auto_size_params,
+                                  &create_guest_params.resize_guest_params);
     browser_plugin_manager()->Send(
         new BrowserPluginHostMsg_CreateGuest(
             render_view_routing_id_,
             instance_id_,
             create_guest_params));
   }
 
   browser_plugin_manager()->Send(
       new BrowserPluginHostMsg_NavigateGuest(
           render_view_routing_id_,
@@ skipping 30 matching lines @@
 }
 
 void BrowserPlugin::UpdateGuestAutoSizeState() {
   // If we haven't yet heard back from the guest about the last resize request,
   // then we don't issue another request until we do in
   // BrowserPlugin::UpdateRect.
   if (!navigate_src_sent_ || pending_damage_buffer_)
     return;
   BrowserPluginHostMsg_AutoSize_Params auto_size_params;
   BrowserPluginHostMsg_ResizeGuest_Params resize_guest_params;
-  pending_damage_buffer_ =
-      GetDamageBufferWithSizeParams(&auto_size_params, &resize_guest_params);
+  GetDamageBufferWithSizeParams(&auto_size_params, &resize_guest_params);
   browser_plugin_manager()->Send(new BrowserPluginHostMsg_SetAutoSize(
       render_view_routing_id_,
       instance_id_,
       auto_size_params,
       resize_guest_params));
 }
 
 void BrowserPlugin::SizeChangedDueToAutoSize(const gfx::Size& old_view_size) {
   size_changed_in_flight_ = false;
 
   std::map<std::string, base::Value*> props;
   props[kOldHeight] = base::Value::CreateIntegerValue(old_view_size.height());
   props[kOldWidth] = base::Value::CreateIntegerValue(old_view_size.width());
   props[kNewHeight] = base::Value::CreateIntegerValue(last_view_size_.height());
   props[kNewWidth] = base::Value::CreateIntegerValue(last_view_size_.width());
   TriggerEvent(kEventSizeChanged, &props);
 }
 
-#if defined(OS_MACOSX)
-bool BrowserPlugin::DamageBufferMatches(
-    const TransportDIB* damage_buffer,
-    const TransportDIB::Id& other_damage_buffer_id) {
-  if (!damage_buffer)
+// static
+bool BrowserPlugin::UsesDamageBuffer(
+    const BrowserPluginMsg_UpdateRect_Params& params) {
+  return params.damage_buffer_sequence_id != 0;
+}
+
+bool BrowserPlugin::UsesPendingDamageBuffer(
+    const BrowserPluginMsg_UpdateRect_Params& params) {
+  if (!pending_damage_buffer_.get())
     return false;
-  return damage_buffer->id() == other_damage_buffer_id;
+  return damage_buffer_sequence_id_ == params.damage_buffer_sequence_id;
 }
-#else
-bool BrowserPlugin::DamageBufferMatches(
-    const TransportDIB* damage_buffer,
-    const TransportDIB::Handle& other_damage_buffer_handle) {
-  if (!damage_buffer)
-    return false;
-  return damage_buffer->handle() == other_damage_buffer_handle;
-}
-#endif
 
 void BrowserPlugin::OnAdvanceFocus(int instance_id, bool reverse) {
   DCHECK(render_view_);
   render_view_->GetWebView()->advanceFocus(reverse);
 }
 
 void BrowserPlugin::OnGuestContentWindowReady(int instance_id,
                                             int content_window_routing_id) {
   DCHECK(content_window_routing_id != MSG_ROUTING_NONE);
   content_window_routing_id_ = content_window_routing_id;
@@ skipping 108 matching lines @@
     int instance_id,
     int message_id,
     const BrowserPluginMsg_UpdateRect_Params& params) {
   bool use_new_damage_buffer = !backing_store_;
   BrowserPluginHostMsg_AutoSize_Params auto_size_params;
   BrowserPluginHostMsg_ResizeGuest_Params resize_guest_params;
   // If we have a pending damage buffer, and the guest has begun to use the
   // damage buffer then we know the guest will no longer use the current
   // damage buffer. At this point, we drop the current damage buffer, and
   // mark the pending damage buffer as the current damage buffer.
-  if (DamageBufferMatches(pending_damage_buffer_,
-                          params.damage_buffer_identifier)) {
+  if (UsesPendingDamageBuffer(params)) {
     SwapDamageBuffers();
     use_new_damage_buffer = true;
   }
   if ((!auto_size_ &&
        (width() != params.view_size.width() ||
         height() != params.view_size.height())) ||
       (auto_size_ && (!InAutoSizeBounds(params.view_size)))) {
     if (pending_damage_buffer_) {
       // The guest has not yet responded to the last resize request, and
       // so we don't want to do anything at this point other than ACK the guest.
       PopulateAutoSizeParameters(&auto_size_params);
     } else {
       // If we have no pending damage buffer, then the guest has not caught up
       // with the BrowserPlugin container. We now tell the guest about the new
       // container size.
-      pending_damage_buffer_ =
-          GetDamageBufferWithSizeParams(&auto_size_params,
-                                        &resize_guest_params);
+      GetDamageBufferWithSizeParams(&auto_size_params,
+                                    &resize_guest_params);
     }
     browser_plugin_manager()->Send(new BrowserPluginHostMsg_UpdateRect_ACK(
         render_view_routing_id_,
         instance_id_,
         message_id,
         auto_size_params,
         resize_guest_params));
     return;
   }
 
@@ skipping 34 matching lines @@
 
   // Update the backing store.
   if (!params.scroll_rect.IsEmpty()) {
     backing_store_->ScrollBackingStore(params.scroll_delta,
                                        params.scroll_rect,
                                        params.view_size);
   }
   for (unsigned i = 0; i < params.copy_rects.size(); i++) {
     backing_store_->PaintToBackingStore(params.bitmap_rect,
                                         params.copy_rects,
-                                        current_damage_buffer_);
+                                        current_damage_buffer_->memory());
   }
   // Invalidate the container.
   // If the BrowserPlugin is scheduled to be deleted, then container_ will be
   // NULL so we shouldn't attempt to access it.
   if (container_)
     container_->invalidate();
   PopulateAutoSizeParameters(&auto_size_params);
   browser_plugin_manager()->Send(new BrowserPluginHostMsg_UpdateRect_ACK(
       render_view_routing_id_,
       instance_id_,
@@ skipping 340 matching lines @@
   // resized. If |pending_damage_buffer_|, then we are still waiting on a
   // previous resize to be ACK'ed and so we don't issue additional resizes
   // until the previous one is ACK'ed.
   if (!navigate_src_sent_ || auto_size_ || pending_damage_buffer_ ||
       (old_width == window_rect.width &&
        old_height == window_rect.height)) {
     return;
   }
 
   BrowserPluginHostMsg_ResizeGuest_Params params;
-  pending_damage_buffer_ =
-      PopulateResizeGuestParameters(&params, gfx::Size(width(), height()));
+  PopulateResizeGuestParameters(&params, gfx::Size(width(), height()));
   browser_plugin_manager()->Send(new BrowserPluginHostMsg_ResizeGuest(
       render_view_routing_id_,
       instance_id_,
       params));
 }
 
-void BrowserPlugin::FreeDamageBuffer(TransportDIB** damage_buffer) {
-  DCHECK(damage_buffer);
-  DCHECK(*damage_buffer);
-#if defined(OS_MACOSX)
-  // We don't need to (nor should we) send ViewHostMsg_FreeTransportDIB
-  // message to the browser to free the damage buffer since we manage the
-  // damage buffer ourselves.
-  delete *damage_buffer;
-#else
-  RenderProcess::current()->FreeTransportDIB(*damage_buffer);
-  *damage_buffer = NULL;
-#endif
+void BrowserPlugin::SwapDamageBuffers() {
+  current_damage_buffer_.reset(pending_damage_buffer_.release());
 }
 
-void BrowserPlugin::SwapDamageBuffers() {
-  if (current_damage_buffer_)
-    FreeDamageBuffer(&current_damage_buffer_);
-  current_damage_buffer_ = pending_damage_buffer_;
-  pending_damage_buffer_ = NULL;
-}
-
-TransportDIB* BrowserPlugin::PopulateResizeGuestParameters(
+void BrowserPlugin::PopulateResizeGuestParameters(
     BrowserPluginHostMsg_ResizeGuest_Params* params,
     const gfx::Size& view_size) {
   const size_t stride = skia::PlatformCanvasStrideForWidth(view_size.width());
   // Make sure the size of the damage buffer is at least four bytes so that we
   // can fit in a magic word to verify that the memory is shared correctly.
   size_t size =
       std::max(sizeof(unsigned int),
                static_cast<size_t>(view_size.height() *
                                    stride *
                                    GetDeviceScaleFactor() *
                                    GetDeviceScaleFactor()));
 
-  TransportDIB* new_damage_buffer = CreateTransportDIB(size);
-  params->damage_buffer_id = new_damage_buffer->id();
-#if defined(OS_MACOSX)
-  // |damage_buffer_id| is not enough to retrieve the damage buffer (on browser
-  // side) since we don't let the browser cache the damage buffer. We need a
-  // handle to the damage buffer for this.
-  params->damage_buffer_handle = new_damage_buffer->handle();
-#endif
-#if defined(OS_WIN)
   params->damage_buffer_size = size;
-#endif
   params->view_size = view_size;
   params->scale_factor = GetDeviceScaleFactor();
-  return new_damage_buffer;
+  pending_damage_buffer_.reset(
+      CreateDamageBuffer(size, &params->damage_buffer_handle));
+  if (!pending_damage_buffer_.get())
+    NOTREACHED();
+  params->damage_buffer_sequence_id = ++damage_buffer_sequence_id_;
 }
 
-TransportDIB* BrowserPlugin::GetDamageBufferWithSizeParams(
+void BrowserPlugin::GetDamageBufferWithSizeParams(
     BrowserPluginHostMsg_AutoSize_Params* auto_size_params,
     BrowserPluginHostMsg_ResizeGuest_Params* resize_guest_params) {
   PopulateAutoSizeParameters(auto_size_params);
   gfx::Size view_size = auto_size_params->enable ? auto_size_params->max_size :
       gfx::Size(width(), height());
   if (view_size.IsEmpty())
-    return NULL;
-  return PopulateResizeGuestParameters(resize_guest_params, view_size);
+    return;
+  PopulateResizeGuestParameters(resize_guest_params, view_size);
 }
 
-TransportDIB* BrowserPlugin::CreateTransportDIB(const size_t size) {
-#if defined(OS_MACOSX)
-  TransportDIB::Handle handle;
-  // On OSX we don't let the browser manage the transport dib. We manage the
-  // deletion of the dib in FreeDamageBuffer().
-  IPC::Message* msg = new ViewHostMsg_AllocTransportDIB(
-      size,
-      false,  // cache in browser.
-      &handle);
-  TransportDIB* new_damage_buffer = NULL;
-  if (browser_plugin_manager()->Send(msg) && handle.fd >= 0)
-    new_damage_buffer = TransportDIB::Map(handle);
-#else
-  TransportDIB* new_damage_buffer =
-      RenderProcess::current()->CreateTransportDIB(size);
+#if defined(OS_POSIX)
+base::SharedMemory* BrowserPlugin::CreateDamageBuffer(
+    const size_t size,
+    base::SharedMemoryHandle* damage_buffer_handle) {
+  scoped_ptr<base::SharedMemory> shared_buf(
+      content::RenderThread::Get()->HostAllocateSharedMemoryBuffer(
+          size).release());
+
+  if (shared_buf.get()) {
+    if (shared_buf->Map(size)) {
+      // Insert the magic word.
+      *static_cast<unsigned int*>(shared_buf->memory()) = 0xdeadbeef;
+      shared_buf->ShareToProcess(base::GetCurrentProcessHandle(),
+                                 damage_buffer_handle);
+      return shared_buf.release();
+    }
+  }
+  NOTREACHED();
+  return NULL;
+}
+#elif defined(OS_WIN)
+base::SharedMemory* BrowserPlugin::CreateDamageBuffer(
+    const size_t size,
+    base::SharedMemoryHandle* damage_buffer_handle) {
+  scoped_ptr<base::SharedMemory> shared_buf(new base::SharedMemory());
+
+  if (!shared_buf->CreateAndMapAnonymous(size)) {
+    NOTREACHED() << "Buffer allocation failed";
+    return NULL;
+  }
+  // Insert the magic word.
+  *static_cast<unsigned int*>(shared_buf->memory()) = 0xdeadbeef;
+  if (shared_buf->ShareToProcess(base::GetCurrentProcessHandle(),
+                                 damage_buffer_handle))
+      return shared_buf.release();
+  NOTREACHED();
+  return NULL;
+}
 #endif
-  if (!new_damage_buffer)
-    NOTREACHED() << "Unable to create damage buffer";
-#if defined(OS_WIN)
-  // Windows does not map the buffer by default.
-  CHECK(new_damage_buffer->Map());
-#endif
-  DCHECK(new_damage_buffer->memory());
-  // Insert the magic word.
-  *static_cast<unsigned int*>(new_damage_buffer->memory()) = 0xdeadbeef;
-  return new_damage_buffer;
-}
 
 void BrowserPlugin::updateFocus(bool focused) {
   if (plugin_focused_ == focused)
     return;
 
   bool old_guest_focus_state = ShouldGuestBeFocused();
   plugin_focused_ = focused;
 
   if (ShouldGuestBeFocused() != old_guest_focus_state)
     UpdateGuestFocusState();
@@ skipping 66 matching lines @@
                                                  void* notify_data) {
 }
 
 void BrowserPlugin::didFailLoadingFrameRequest(
     const WebKit::WebURL& url,
     void* notify_data,
     const WebKit::WebURLError& error) {
 }
 
 }  // namespace content