WireServer: check buffer exists before sending the map callback

The client might have asked for the buffer to be destroyed, but the
reference to the buffer is still alive because it is internally
referenced by Dawn.

BUG=chromium:918254

Change-Id: Id7d2de891eba98e3cf15e77730f66f64d9a3b9f9
Reviewed-on: https://dawn-review.googlesource.com/c/3622
Reviewed-by: Austin Eng <enga@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
This commit is contained in:
Corentin Wallez 2019-01-04 09:54:40 +00:00 committed by Commit Bot service account
parent a19c759bc4
commit 1e37db5350
1 changed files with 14 additions and 5 deletions

View File

@ -326,6 +326,12 @@ namespace dawn_wire {
{% endfor %}
void OnMapReadAsyncCallback(dawnBufferMapAsyncStatus status, const void* ptr, MapUserdata* data) {
// Skip sending the callback if the buffer has already been destroyed.
auto* bufferData = mKnownBuffer.Get(data->bufferId);
if (bufferData == nullptr || bufferData->serial != data->bufferSerial) {
return;
}
ReturnBufferMapReadAsyncCallbackCmd cmd;
cmd.bufferId = data->bufferId;
cmd.bufferSerial = data->bufferSerial;
@ -347,6 +353,12 @@ namespace dawn_wire {
}
void OnMapWriteAsyncCallback(dawnBufferMapAsyncStatus status, void* ptr, MapUserdata* data) {
// Skip sending the callback if the buffer has already been destroyed.
auto* bufferData = mKnownBuffer.Get(data->bufferId);
if (bufferData == nullptr || bufferData->serial != data->bufferSerial) {
return;
}
ReturnBufferMapWriteAsyncCallbackCmd cmd;
cmd.bufferId = data->bufferId;
cmd.bufferSerial = data->bufferSerial;
@ -357,11 +369,8 @@ namespace dawn_wire {
*allocCmd = cmd;
if (status == DAWN_BUFFER_MAP_ASYNC_STATUS_SUCCESS) {
auto* selfData = mKnownBuffer.Get(data->bufferId);
ASSERT(selfData != nullptr);
selfData->mappedData = ptr;
selfData->mappedDataSize = data->size;
bufferData->mappedData = ptr;
bufferData->mappedDataSize = data->size;
}
delete data;