Convert plugin and GPU process to brokered handle duplication.

content/renderer/webplugin_delegate_proxy.cc

Index: content/renderer/webplugin_delegate_proxy.cc
===================================================================
--- content/renderer/webplugin_delegate_proxy.cc	(revision 132263)
+++ content/renderer/webplugin_delegate_proxy.cc	(working copy)
@@ -18,6 +18,7 @@
 #include "base/logging.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/process.h"
 #include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
@@ -60,6 +61,10 @@
 #include "base/mac/mac_util.h"
 #endif
 
+#if defined(OS_WIN)
+#include "content/common/sandbox_policy.h"
+#endif
+
 using WebKit::WebBindings;
 using WebKit::WebCursorInfo;
 using WebKit::WebDragData;
@@ -484,7 +489,8 @@
 
 static void CopyTransportDIBHandleForMessage(
     const TransportDIB::Handle& handle_in,
-    TransportDIB::Handle* handle_out) {
+    TransportDIB::Handle* handle_out,
+    base::ProcessId peer_pid) {
 #if defined(OS_MACOSX)
   // On Mac, TransportDIB::Handle is typedef'ed to FileDescriptor, and
   // FileDescriptor message fields needs to remain valid until the message is
@@ -494,6 +500,12 @@
     return;
   }
   handle_out->auto_close = true;
+#elif defined(OS_WIN)
+  // On Windows we need to duplicate the handle for the plugin process.
+  *handle_out = NULL;
+  sandbox::BrokerDuplicateHandle(handle_in, peer_pid, handle_out,
+                                 FILE_MAP_READ | FILE_MAP_WRITE, 0);
+  CHECK(*handle_out != NULL);
 #else
   // Don't need to do anything special for other platforms.
   *handle_out = handle_in;
@@ -520,15 +532,18 @@
   {
     if (transport_stores_[0].dib.get())
       CopyTransportDIBHandleForMessage(transport_stores_[0].dib->handle(),
-                                       &param.windowless_buffer0);
+                                       &param.windowless_buffer0,
+                                       channel_host_->peer_pid());
 
     if (transport_stores_[1].dib.get())
       CopyTransportDIBHandleForMessage(transport_stores_[1].dib->handle(),
-                                       &param.windowless_buffer1);
+                                       &param.windowless_buffer1,
+                                       channel_host_->peer_pid());
 
     if (background_store_.dib.get())
       CopyTransportDIBHandleForMessage(background_store_.dib->handle(),
-                                       &param.background_buffer);
+                                       &param.background_buffer,
+                                       channel_host_->peer_pid());
   }
 
   IPC::Message* msg;