1 files changed, 42 insertions, 24 deletions

diff --git a/chromium/content/browser/gpu/gpu_process_host.cc b/chromium/content/browser/gpu/gpu_process_host.cc
index 4f9f69fb0f9..6b1df02f7fe 100644
--- a/chromium/content/browser/gpu/gpu_process_host.cc
+++ b/chromium/content/browser/gpu/gpu_process_host.cc
@@ -445,6 +445,14 @@ void GpuProcessHost::CallOnIO(
       base::Bind(&RunCallbackOnIO, kind, force_create, callback));
 }
 
+GpuProcessHost::EstablishChannelRequest::EstablishChannelRequest()
+    : client_id(0) {}
+
+GpuProcessHost::EstablishChannelRequest::EstablishChannelRequest(
+    const EstablishChannelRequest& other) = default;
+
+GpuProcessHost::EstablishChannelRequest::~EstablishChannelRequest() {}
+
 service_manager::InterfaceProvider* GpuProcessHost::GetRemoteInterfaces() {
   return process_->child_connection()->GetRemoteInterfaces();
 }
@@ -470,8 +478,7 @@ GpuProcessHost::GpuProcessHost(int host_id, GpuProcessKind kind)
       kind_(kind),
       process_launched_(false),
       initialized_(false),
-      gpu_host_binding_(this),
-      weak_ptr_factory_(this) {
+      gpu_host_binding_(this) {
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSingleProcess) ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -680,6 +687,7 @@ bool GpuProcessHost::OnMessageReceived(const IPC::Message& message) {
   DCHECK(CalledOnValidThread());
   IPC_BEGIN_MESSAGE_MAP(GpuProcessHost, message)
     IPC_MESSAGE_HANDLER(GpuHostMsg_Initialized, OnInitialized)
+    IPC_MESSAGE_HANDLER(GpuHostMsg_ChannelEstablished, OnChannelEstablished)
     IPC_MESSAGE_HANDLER(GpuHostMsg_GpuMemoryBufferCreated,
                         OnGpuMemoryBufferCreated)
 #if defined(OS_ANDROID)
@@ -719,15 +727,21 @@ void GpuProcessHost::EstablishGpuChannel(
     return;
   }
 
-  DCHECK_EQ(preempts, allow_view_command_buffers);
-  DCHECK_EQ(preempts, allow_real_time_streams);
-  bool is_gpu_host = preempts;
-
-  channel_requests_.push(callback);
-  gpu_service_ptr_->EstablishGpuChannel(
-      client_id, client_tracing_id, is_gpu_host,
-      base::Bind(&GpuProcessHost::OnChannelEstablished,
-                 weak_ptr_factory_.GetWeakPtr(), client_id, callback));
+  EstablishChannelParams params;
+  params.client_id = client_id;
+  params.client_tracing_id = client_tracing_id;
+  params.preempts = preempts;
+  params.allow_view_command_buffers = allow_view_command_buffers;
+  params.allow_real_time_streams = allow_real_time_streams;
+  if (Send(new GpuMsg_EstablishChannel(params))) {
+    EstablishChannelRequest request;
+    request.client_id = client_id;
+    request.callback = callback;
+    channel_requests_.push(request);
+  } else {
+    DVLOG(1) << "Failed to send GpuMsg_EstablishChannel.";
+    callback.Run(IPC::ChannelHandle(), gpu::GPUInfo());
+  }
 
   if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kDisableGpuShaderDiskCache)) {
@@ -802,27 +816,32 @@ void GpuProcessHost::OnInitialized(
 }
 
 void GpuProcessHost::OnChannelEstablished(
-    int client_id,
-    const EstablishChannelCallback& callback,
-    mojo::ScopedMessagePipeHandle channel_handle) {
+    const IPC::ChannelHandle& channel_handle) {
   TRACE_EVENT0("gpu", "GpuProcessHost::OnChannelEstablished");
-  DCHECK(!channel_requests_.empty());
-  DCHECK(channel_requests_.front().Equals(callback));
+
+  if (channel_requests_.empty()) {
+    // This happens when GPU process is compromised.
+    RouteOnUIThread(GpuHostMsg_OnLogMessage(
+        logging::LOG_WARNING, "WARNING",
+        "Received a ChannelEstablished message but no requests in queue."));
+    return;
+  }
+  EstablishChannelRequest request = channel_requests_.front();
   channel_requests_.pop();
 
   // Currently if any of the GPU features are blacklisted, we don't establish a
   // GPU channel.
-  if (channel_handle.is_valid() &&
-      !GpuDataManagerImpl::GetInstance()->GpuAccessAllowed(nullptr)) {
-    Send(new GpuMsg_CloseChannel(client_id));
-    callback.Run(IPC::ChannelHandle(), gpu::GPUInfo());
+  if (channel_handle.mojo_handle.is_valid() &&
+      !GpuDataManagerImpl::GetInstance()->GpuAccessAllowed(NULL)) {
+    Send(new GpuMsg_CloseChannel(request.client_id));
+    request.callback.Run(IPC::ChannelHandle(), gpu::GPUInfo());
     RouteOnUIThread(
         GpuHostMsg_OnLogMessage(logging::LOG_WARNING, "WARNING",
                                 "Hardware acceleration is unavailable."));
     return;
   }
 
-  callback.Run(IPC::ChannelHandle(channel_handle.release()), gpu_info_);
+  request.callback.Run(channel_handle, gpu_info_);
 }
 
 void GpuProcessHost::OnGpuMemoryBufferCreated(
@@ -1082,12 +1101,11 @@ bool GpuProcessHost::LaunchGpuProcess(gpu::GpuPreferences* gpu_preferences) {
 
 void GpuProcessHost::SendOutstandingReplies() {
   valid_ = false;
-
   // First send empty channel handles for all EstablishChannel requests.
   while (!channel_requests_.empty()) {
-    auto callback = channel_requests_.front();
+    EstablishChannelRequest request = channel_requests_.front();
     channel_requests_.pop();
-    callback.Run(IPC::ChannelHandle(), gpu::GPUInfo());
+    request.callback.Run(IPC::ChannelHandle(), gpu::GPUInfo());
   }
 
   while (!create_gpu_memory_buffer_requests_.empty()) {