commit 1e37db53507eb9a2286c67a50171f76d05f754d9
author Corentin Wallez <cwallez@chromium.org> Fri Jan 04 09:54:40 2019 +0000
committer Commit Bot service account <commit-bot@chromium.org> Fri Jan 04 09:54:40 2019 +0000
tree fa8980f568ead12d972e8d6f037a529a956a7bf7
parent a19c759bc46528f897f5aaacfc1d78a461b917e8

WireServer: check buffer exists before sending the map callback

The client might have asked for the buffer to be destroyed, but the
reference to the buffer is still alive because it is internally
referenced by Dawn.

BUG=chromium:918254

Change-Id: Id7d2de891eba98e3cf15e77730f66f64d9a3b9f9
Reviewed-on: https://dawn-review.googlesource.com/c/3622
Reviewed-by: Austin Eng <enga@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>

generator/templates/dawn_wire/WireServer.cpp

diff --git a/generator/templates/dawn_wire/WireServer.cpp b/generator/templates/dawn_wire/WireServer.cpp
index 1f4c090..99d91d6 100644
--- a/generator/templates/dawn_wire/WireServer.cpp
+++ b/generator/templates/dawn_wire/WireServer.cpp
@@ -326,6 +326,12 @@
                 {% endfor %}
 
                 void OnMapReadAsyncCallback(dawnBufferMapAsyncStatus status, const void* ptr, MapUserdata* data) {
+                    // Skip sending the callback if the buffer has already been destroyed.
+                    auto* bufferData = mKnownBuffer.Get(data->bufferId);
+                    if (bufferData == nullptr || bufferData->serial != data->bufferSerial) {
+                        return;
+                    }
+
                     ReturnBufferMapReadAsyncCallbackCmd cmd;
                     cmd.bufferId = data->bufferId;
                     cmd.bufferSerial = data->bufferSerial;
@@ -347,6 +353,12 @@
                 }
 
                 void OnMapWriteAsyncCallback(dawnBufferMapAsyncStatus status, void* ptr, MapUserdata* data) {
+                    // Skip sending the callback if the buffer has already been destroyed.
+                    auto* bufferData = mKnownBuffer.Get(data->bufferId);
+                    if (bufferData == nullptr || bufferData->serial != data->bufferSerial) {
+                        return;
+                    }
+
                     ReturnBufferMapWriteAsyncCallbackCmd cmd;
                     cmd.bufferId = data->bufferId;
                     cmd.bufferSerial = data->bufferSerial;
@@ -357,11 +369,8 @@
                     *allocCmd = cmd;
 
                     if (status == DAWN_BUFFER_MAP_ASYNC_STATUS_SUCCESS) {
-                        auto* selfData = mKnownBuffer.Get(data->bufferId);
-                        ASSERT(selfData != nullptr);
-
-                        selfData->mappedData = ptr;
-                        selfData->mappedDataSize = data->size;
+                        bufferData->mappedData = ptr;
+                        bufferData->mappedDataSize = data->size;
                     }
 
                     delete data;