Use SharedBitmapManager to allocate software frames.

This reduces the number of ways to allocate cross-process bitmaps.

BUG=

Review URL: https://codereview.chromium.org/227703009

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@262620 0039d316-1c4b-4281-b951-d872f2087c98

15 files changed, 100 insertions, 123 deletions

diff --git a/cc/output/software_frame_data.cc b/cc/output/software_frame_data.cc
index 0b43032..7fc380e 100644
--- a/cc/output/software_frame_data.cc
+++ b/cc/output/software_frame_data.cc
@@ -6,9 +6,7 @@
 
 namespace cc {
 
-SoftwareFrameData::SoftwareFrameData()
-    : id(0),
-      handle(base::SharedMemory::NULLHandle()) {}
+SoftwareFrameData::SoftwareFrameData() : id(0) {}
 
 SoftwareFrameData::~SoftwareFrameData() {}
 
diff --git a/cc/output/software_frame_data.h b/cc/output/software_frame_data.h
index b7fb44a..0a9c345 100644
--- a/cc/output/software_frame_data.h
+++ b/cc/output/software_frame_data.h
@@ -5,8 +5,8 @@
 #ifndef CC_OUTPUT_SOFTWARE_FRAME_DATA_H_
 #define CC_OUTPUT_SOFTWARE_FRAME_DATA_H_
 
-#include "base/memory/shared_memory.h"
 #include "cc/base/cc_export.h"
+#include "cc/resources/shared_bitmap.h"
 #include "ui/gfx/rect.h"
 
 namespace cc {
@@ -19,7 +19,7 @@ class CC_EXPORT SoftwareFrameData {
   unsigned id;
   gfx::Size size;
   gfx::Rect damage_rect;
-  base::SharedMemoryHandle handle;
+  SharedBitmapId bitmap_id;
 };
 
 }  // namespace cc
diff --git a/cc/output/software_output_device.cc b/cc/output/software_output_device.cc
index 428ba9b..93860f1 100644
--- a/cc/output/software_output_device.cc
+++ b/cc/output/software_output_device.cc
@@ -37,7 +37,6 @@ void SoftwareOutputDevice::EndPaint(SoftwareFrameData* frame_data) {
   frame_data->id = 0;
   frame_data->size = viewport_size_;
   frame_data->damage_rect = damage_rect_;
-  frame_data->handle = base::SharedMemory::NULLHandle();
 }
 
 void SoftwareOutputDevice::CopyToPixels(const gfx::Rect& rect, void* pixels) {
diff --git a/content/browser/frame_host/render_widget_host_view_guest.cc b/content/browser/frame_host/render_widget_host_view_guest.cc
index 4501efa..be692c8 100644
--- a/content/browser/frame_host/render_widget_host_view_guest.cc
+++ b/content/browser/frame_host/render_widget_host_view_guest.cc
@@ -12,6 +12,7 @@
 #include "content/common/browser_plugin/browser_plugin_messages.h"
 #include "content/common/frame_messages.h"
 #include "content/common/gpu/gpu_messages.h"
+#include "content/common/host_shared_bitmap_manager.h"
 #include "content/common/view_messages.h"
 #include "content/common/webplugin_geometry.h"
 #include "content/public/common/content_switches.h"
@@ -197,21 +198,22 @@ void RenderWidgetHostViewGuest::OnSwapCompositorFrame(
     // the frame to.
     return;
   }
+  base::SharedMemoryHandle software_frame_handle =
+      base::SharedMemory::NULLHandle();
   if (frame->software_frame_data) {
     cc::SoftwareFrameData* frame_data = frame->software_frame_data.get();
-#ifdef OS_WIN
-    base::SharedMemory shared_memory(frame_data->handle, true,
-                                     host_->GetProcess()->GetHandle());
-#else
-    base::SharedMemory shared_memory(frame_data->handle, true);
-#endif
+    scoped_ptr<cc::SharedBitmap> bitmap =
+        HostSharedBitmapManager::current()->GetSharedBitmapFromId(
+            frame_data->size, frame_data->bitmap_id);
+    if (!bitmap)
+      return;
 
     RenderWidgetHostView* embedder_rwhv =
         guest_->GetEmbedderRenderWidgetHostView();
     base::ProcessHandle embedder_pid =
         embedder_rwhv->GetRenderWidgetHost()->GetProcess()->GetHandle();
 
-    shared_memory.GiveToProcess(embedder_pid, &frame_data->handle);
+    bitmap->memory()->ShareToProcess(embedder_pid, &software_frame_handle);
   }
 
   FrameMsg_CompositorFrameSwapped_Params guest_params;
@@ -219,6 +221,7 @@ void RenderWidgetHostViewGuest::OnSwapCompositorFrame(
   guest_params.output_surface_id = output_surface_id;
   guest_params.producing_route_id = host_->GetRoutingID();
   guest_params.producing_host_id = host_->GetProcess()->GetID();
+  guest_params.shared_memory_handle = software_frame_handle;
 
   guest_->SendMessageToEmbedder(
       new BrowserPluginMsg_CompositorFrameSwapped(guest_->instance_id(),
diff --git a/content/browser/renderer_host/software_frame_manager.cc b/content/browser/renderer_host/software_frame_manager.cc
index d4fc273..08ac500 100644
--- a/content/browser/renderer_host/software_frame_manager.cc
+++ b/content/browser/renderer_host/software_frame_manager.cc
@@ -10,6 +10,7 @@
 #include "base/numerics/safe_math.h"
 #include "cc/resources/shared_bitmap.h"
 #include "content/browser/renderer_host/dip_util.h"
+#include "content/common/host_shared_bitmap_manager.h"
 #include "content/public/browser/user_metrics.h"
 
 namespace {
@@ -30,13 +31,12 @@ class CONTENT_EXPORT SoftwareFrame : public base::RefCounted<SoftwareFrame> {
   friend class base::RefCounted<SoftwareFrame>;
   friend class SoftwareFrameManager;
 
-  SoftwareFrame(
-    base::WeakPtr<SoftwareFrameManagerClient> frame_manager_client,
-    uint32 output_surface_id,
-    unsigned frame_id,
-    float frame_device_scale_factor,
-    gfx::Size frame_size_pixels,
-    scoped_ptr<base::SharedMemory> shared_memory);
+  SoftwareFrame(base::WeakPtr<SoftwareFrameManagerClient> frame_manager_client,
+                uint32 output_surface_id,
+                unsigned frame_id,
+                float frame_device_scale_factor,
+                gfx::Size frame_size_pixels,
+                scoped_ptr<cc::SharedBitmap> shared_bitmap);
   ~SoftwareFrame();
 
   base::WeakPtr<SoftwareFrameManagerClient> frame_manager_client_;
@@ -44,7 +44,7 @@ class CONTENT_EXPORT SoftwareFrame : public base::RefCounted<SoftwareFrame> {
   const unsigned frame_id_;
   float frame_device_scale_factor_;
   const gfx::Size frame_size_pixels_;
-  scoped_ptr<base::SharedMemory> shared_memory_;
+  scoped_ptr<cc::SharedBitmap> shared_bitmap_;
 
   DISALLOW_COPY_AND_ASSIGN(SoftwareFrame);
 };
@@ -55,13 +55,13 @@ SoftwareFrame::SoftwareFrame(
     unsigned frame_id,
     float frame_device_scale_factor,
     gfx::Size frame_size_pixels,
-    scoped_ptr<base::SharedMemory> shared_memory)
+    scoped_ptr<cc::SharedBitmap> shared_bitmap)
     : frame_manager_client_(frame_manager_client),
       output_surface_id_(output_surface_id),
       frame_id_(frame_id),
       frame_device_scale_factor_(frame_device_scale_factor),
       frame_size_pixels_(frame_size_pixels),
-      shared_memory_(shared_memory.Pass()) {}
+      shared_bitmap_(shared_bitmap.Pass()) {}
 
 SoftwareFrame::~SoftwareFrame() {
   if (frame_manager_client_) {
@@ -86,54 +86,23 @@ bool SoftwareFrameManager::SwapToNewFrame(
     const cc::SoftwareFrameData* frame_data,
     float frame_device_scale_factor,
     base::ProcessHandle process_handle) {
-
-#ifdef OS_WIN
-  scoped_ptr<base::SharedMemory> shared_memory(
-      new base::SharedMemory(frame_data->handle, true,
-                             process_handle));
-#else
-  scoped_ptr<base::SharedMemory> shared_memory(
-      new base::SharedMemory(frame_data->handle, true));
-#endif
-
-  // The NULL handle is used in testing.
-  if (base::SharedMemory::IsHandleValid(shared_memory->handle())) {
-    DCHECK(cc::SharedBitmap::VerifySizeInBytes(frame_data->size));
-    // UncheckedSizeInBytes is okay because the frame_data size was verified
-    // when frame_data was received over IPC.
-    size_t size_in_bytes =
-        cc::SharedBitmap::UncheckedSizeInBytes(frame_data->size);
-#ifdef OS_WIN
-    if (!shared_memory->Map(0)) {
-      DLOG(ERROR) << "Unable to map renderer memory.";
-      RecordAction(
-          base::UserMetricsAction("BadMessageTerminate_SharedMemoryManager1"));
-      return false;
-    }
-
-    if (shared_memory->mapped_size() < size_in_bytes) {
-      DLOG(ERROR) << "Shared memory too small for given rectangle";
-      RecordAction(
-          base::UserMetricsAction("BadMessageTerminate_SharedMemoryManager2"));
-      return false;
-    }
-#else
-    if (!shared_memory->Map(size_in_bytes)) {
-      DLOG(ERROR) << "Unable to map renderer memory.";
-      RecordAction(
-          base::UserMetricsAction("BadMessageTerminate_SharedMemoryManager1"));
-      return false;
-    }
-#endif
+  scoped_ptr<cc::SharedBitmap> shared_bitmap =
+      HostSharedBitmapManager::current()->GetSharedBitmapFromId(
+          frame_data->size, frame_data->bitmap_id);
+
+  if (!shared_bitmap) {
+    RecordAction(
+        base::UserMetricsAction("BadMessageTerminate_SharedMemoryManager1"));
+    return false;
   }
 
-  scoped_refptr<SoftwareFrame> next_frame(new SoftwareFrame(
-      client_,
-      output_surface_id,
-      frame_data->id,
-      frame_device_scale_factor,
-      frame_data->size,
-      shared_memory.Pass()));
+  scoped_refptr<SoftwareFrame> next_frame(
+      new SoftwareFrame(client_,
+                        output_surface_id,
+                        frame_data->id,
+                        frame_device_scale_factor,
+                        frame_data->size,
+                        shared_bitmap.Pass()));
   current_frame_.swap(next_frame);
   return true;
 }
@@ -173,17 +142,16 @@ void SoftwareFrameManager::GetCurrentFrameMailbox(
     cc::TextureMailbox* mailbox,
     scoped_ptr<cc::SingleReleaseCallback>* callback) {
   DCHECK(HasCurrentFrame());
-  *mailbox = cc::TextureMailbox(
-      current_frame_->shared_memory_.get(), current_frame_->frame_size_pixels_);
+  *mailbox = cc::TextureMailbox(current_frame_->shared_bitmap_->memory(),
+                                current_frame_->frame_size_pixels_);
   *callback = cc::SingleReleaseCallback::Create(
       base::Bind(ReleaseMailbox, current_frame_));
 }
 
 void* SoftwareFrameManager::GetCurrentFramePixels() const {
   DCHECK(HasCurrentFrame());
-  DCHECK(base::SharedMemory::IsHandleValid(
-      current_frame_->shared_memory_->handle()));
-  return current_frame_->shared_memory_->memory();
+  DCHECK(current_frame_->shared_bitmap_);
+  return current_frame_->shared_bitmap_->pixels();
 }
 
 float SoftwareFrameManager::GetCurrentFrameDeviceScaleFactor() const {
diff --git a/content/browser/renderer_host/software_frame_manager_unittest.cc b/content/browser/renderer_host/software_frame_manager_unittest.cc
index e234f57..e700f69 100644
--- a/content/browser/renderer_host/software_frame_manager_unittest.cc
+++ b/content/browser/renderer_host/software_frame_manager_unittest.cc
@@ -6,7 +6,10 @@
 
 #include <vector>
 
+#include "base/memory/scoped_vector.h"
+#include "base/memory/shared_memory.h"
 #include "base/sys_info.h"
+#include "content/common/host_shared_bitmap_manager.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -18,9 +21,12 @@ class FakeSoftwareFrameManagerClient : public SoftwareFrameManagerClient {
     software_frame_manager_.reset(new SoftwareFrameManager(
         weak_ptr_factory_.GetWeakPtr()));
   }
-  virtual ~FakeSoftwareFrameManagerClient() {}
-  virtual void SoftwareFrameWasFreed(
-      uint32 output_surface_id, unsigned frame_id) OVERRIDE {
+  virtual ~FakeSoftwareFrameManagerClient() {
+    HostSharedBitmapManager::current()->ProcessRemoved(
+        base::GetCurrentProcessHandle());
+  }
+  virtual void SoftwareFrameWasFreed(uint32 output_surface_id,
+                                     unsigned frame_id) OVERRIDE {
     freed_frames_.push_back(std::make_pair(output_surface_id, frame_id));
   }
   virtual void ReleaseReferencesToSoftwareFrame() OVERRIDE {
@@ -32,7 +38,13 @@ class FakeSoftwareFrameManagerClient : public SoftwareFrameManagerClient {
     frame.id = frame_id;
     frame.size = gfx::Size(1, 1);
     frame.damage_rect = gfx::Rect(frame.size);
-    frame.handle = base::SharedMemory::NULLHandle();
+    frame.bitmap_id = cc::SharedBitmap::GenerateId();
+    scoped_ptr<base::SharedMemory> memory =
+        make_scoped_ptr(new base::SharedMemory);
+    memory->CreateAnonymous(4);
+    HostSharedBitmapManager::current()->ChildAllocatedSharedBitmap(
+        4, memory->handle(), base::GetCurrentProcessHandle(), frame.bitmap_id);
+    allocated_memory_.push_back(memory.release());
     return software_frame_manager_->SwapToNewFrame(
         output_surface, &frame, 1.0, base::GetCurrentProcessHandle());
   }
@@ -46,6 +58,7 @@ class FakeSoftwareFrameManagerClient : public SoftwareFrameManagerClient {
  private:
   std::vector<std::pair<uint32,unsigned> > freed_frames_;
   size_t evicted_count_;
+  ScopedVector<base::SharedMemory> allocated_memory_;
 
   scoped_ptr<SoftwareFrameManager> software_frame_manager_;
   base::WeakPtrFactory<FakeSoftwareFrameManagerClient>
diff --git a/content/common/cc_messages.cc b/content/common/cc_messages.cc
index 1e1e6df..6bca4e4 100644
--- a/content/common/cc_messages.cc
+++ b/content/common/cc_messages.cc
@@ -761,7 +761,7 @@ void ParamTraits<cc::SoftwareFrameData>::Write(Message* m,
   WriteParam(m, p.id);
   WriteParam(m, p.size);
   WriteParam(m, p.damage_rect);
-  WriteParam(m, p.handle);
+  WriteParam(m, p.bitmap_id);
 }
 
 bool ParamTraits<cc::SoftwareFrameData>::Read(const Message* m,
@@ -774,7 +774,7 @@ bool ParamTraits<cc::SoftwareFrameData>::Read(const Message* m,
     return false;
   if (!ReadParam(m, iter, &p->damage_rect))
     return false;
-  if (!ReadParam(m, iter, &p->handle))
+  if (!ReadParam(m, iter, &p->bitmap_id))
     return false;
   return true;
 }
@@ -788,7 +788,7 @@ void ParamTraits<cc::SoftwareFrameData>::Log(const param_type& p,
   l->append(", ");
   LogParam(p.damage_rect, l);
   l->append(", ");
-  LogParam(p.handle, l);
+  LogParam(p.bitmap_id, l);
   l->append(")");
 }
 
diff --git a/content/common/cc_messages_unittest.cc b/content/common/cc_messages_unittest.cc
index 89f510d..09ad85c 100644
--- a/content/common/cc_messages_unittest.cc
+++ b/content/common/cc_messages_unittest.cc
@@ -753,11 +753,7 @@ TEST_F(CCMessagesTest, SoftwareFrameData) {
   frame_in.id = 3;
   frame_in.size = gfx::Size(40, 20);
   frame_in.damage_rect = gfx::Rect(5, 18, 31, 44);
-#if defined(OS_WIN)
-  frame_in.handle = reinterpret_cast<base::SharedMemoryHandle>(23);
-#elif defined(OS_POSIX)
-  frame_in.handle = base::FileDescriptor(23, true);
-#endif
+  frame_in.bitmap_id = cc::SharedBitmap::GenerateId();
 
   // Write the frame.
   IPC::Message msg(1, 2, IPC::Message::PRIORITY_NORMAL);
@@ -771,7 +767,7 @@ TEST_F(CCMessagesTest, SoftwareFrameData) {
   EXPECT_EQ(frame_in.id, frame_out.id);
   EXPECT_EQ(frame_in.size.ToString(), frame_out.size.ToString());
   EXPECT_EQ(frame_in.damage_rect.ToString(), frame_out.damage_rect.ToString());
-  EXPECT_EQ(frame_in.handle, frame_out.handle);
+  EXPECT_EQ(frame_in.bitmap_id, frame_out.bitmap_id);
 }
 
 TEST_F(CCMessagesTest, SoftwareFrameDataMaxInt) {
@@ -779,11 +775,7 @@ TEST_F(CCMessagesTest, SoftwareFrameDataMaxInt) {
   frame_in.id = 3;
   frame_in.size = gfx::Size(40, 20);
   frame_in.damage_rect = gfx::Rect(5, 18, 31, 44);
-#if defined(OS_WIN)
-  frame_in.handle = reinterpret_cast<base::SharedMemoryHandle>(23);
-#elif defined(OS_POSIX)
-  frame_in.handle = base::FileDescriptor(23, true);
-#endif
+  frame_in.bitmap_id = cc::SharedBitmap::GenerateId();
 
   // Write the SoftwareFrameData by hand, make sure it works.
   {
@@ -791,7 +783,7 @@ TEST_F(CCMessagesTest, SoftwareFrameDataMaxInt) {
     IPC::WriteParam(&msg, frame_in.id);
     IPC::WriteParam(&msg, frame_in.size);
     IPC::WriteParam(&msg, frame_in.damage_rect);
-    IPC::WriteParam(&msg, frame_in.handle);
+    IPC::WriteParam(&msg, frame_in.bitmap_id);
     SoftwareFrameData frame_out;
     PickleIterator iter(msg);
     EXPECT_TRUE(
@@ -812,7 +804,7 @@ TEST_F(CCMessagesTest, SoftwareFrameDataMaxInt) {
     IPC::WriteParam(&msg, frame_in.id);
     IPC::WriteParam(&msg, frame_in.size);
     IPC::WriteParam(&msg, frame_in.damage_rect);
-    IPC::WriteParam(&msg, frame_in.handle);
+    IPC::WriteParam(&msg, frame_in.bitmap_id);
     SoftwareFrameData frame_out;
     PickleIterator iter(msg);
     EXPECT_EQ(
diff --git a/content/common/frame_param_macros.h b/content/common/frame_param_macros.h
index 3f37975..023cfd6 100644
--- a/content/common/frame_param_macros.h
+++ b/content/common/frame_param_macros.h
@@ -35,6 +35,7 @@ IPC_STRUCT_BEGIN(FrameMsg_CompositorFrameSwapped_Params)
 
   IPC_STRUCT_MEMBER(cc::CompositorFrame, frame)
   IPC_STRUCT_MEMBER(uint32, output_surface_id)
+  IPC_STRUCT_MEMBER(base::SharedMemoryHandle, shared_memory_handle)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_BuffersSwappedACK_Params)
diff --git a/content/renderer/browser_plugin/browser_plugin.cc b/content/renderer/browser_plugin/browser_plugin.cc
index 587412b..3f9d3af 100644
--- a/content/renderer/browser_plugin/browser_plugin.cc
+++ b/content/renderer/browser_plugin/browser_plugin.cc
@@ -454,7 +454,8 @@ void BrowserPlugin::OnCompositorFrameSwapped(const IPC::Message& message) {
   compositing_helper_->OnCompositorFrameSwapped(frame.Pass(),
                                                 param.b.producing_route_id,
                                                 param.b.output_surface_id,
-                                                param.b.producing_host_id);
+                                                param.b.producing_host_id,
+                                                param.b.shared_memory_handle);
 }
 
 void BrowserPlugin::OnCopyFromCompositingSurface(int guest_instance_id,
diff --git a/content/renderer/child_frame_compositing_helper.cc b/content/renderer/child_frame_compositing_helper.cc
index 20779de..10da97d 100644
--- a/content/renderer/child_frame_compositing_helper.cc
+++ b/content/renderer/child_frame_compositing_helper.cc
@@ -394,7 +394,8 @@ void ChildFrameCompositingHelper::OnCompositorFrameSwapped(
     scoped_ptr<cc::CompositorFrame> frame,
     int route_id,
     uint32 output_surface_id,
-    int host_id) {
+    int host_id,
+    base::SharedMemoryHandle handle) {
 
   if (frame->gl_frame_data) {
     SwapBuffersInfo swap_info;
@@ -422,7 +423,7 @@ void ChildFrameCompositingHelper::OnCompositorFrameSwapped(
     swap_info.software_frame_id = frame_data->id;
 
     scoped_ptr<base::SharedMemory> shared_memory(
-        new base::SharedMemory(frame_data->handle, true));
+        new base::SharedMemory(handle, true));
     const size_t size_in_bytes = 4 * frame_data->size.GetArea();
     if (!shared_memory->Map(size_in_bytes)) {
       LOG(ERROR) << "Failed to map shared memory of size " << size_in_bytes;
diff --git a/content/renderer/child_frame_compositing_helper.h b/content/renderer/child_frame_compositing_helper.h
index b440e39..c33083e 100644
--- a/content/renderer/child_frame_compositing_helper.h
+++ b/content/renderer/child_frame_compositing_helper.h
@@ -10,6 +10,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/shared_memory.h"
 #include "cc/layers/delegated_frame_resource_collection.h"
 #include "content/common/content_export.h"
 #include "gpu/command_buffer/common/mailbox.h"
@@ -76,7 +77,8 @@ class CONTENT_EXPORT ChildFrameCompositingHelper
   void OnCompositorFrameSwapped(scoped_ptr<cc::CompositorFrame> frame,
                                 int route_id,
                                 uint32 output_surface_id,
-                                int host_id);
+                                int host_id,
+                                base::SharedMemoryHandle handle);
   void UpdateVisibility(bool);
   void ChildFrameGone();
 
diff --git a/content/renderer/gpu/compositor_software_output_device.cc b/content/renderer/gpu/compositor_software_output_device.cc
index d1e0293..a8c893b 100644
--- a/content/renderer/gpu/compositor_software_output_device.cc
+++ b/content/renderer/gpu/compositor_software_output_device.cc
@@ -6,7 +6,9 @@
 
 #include "base/logging.h"
 #include "cc/output/software_frame_data.h"
+#include "content/child/child_shared_bitmap_manager.h"
 #include "content/renderer/render_process.h"
+#include "content/renderer/render_thread_impl.h"
 #include "third_party/skia/include/core/SkBitmapDevice.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkPixelRef.h"
@@ -16,12 +18,9 @@
 namespace content {
 
 CompositorSoftwareOutputDevice::Buffer::Buffer(
-    unsigned id, scoped_ptr<base::SharedMemory> mem)
-    : id_(id),
-      mem_(mem.Pass()),
-      free_(true),
-      parent_(NULL) {
-}
+    unsigned id,
+    scoped_ptr<cc::SharedBitmap> bitmap)
+    : id_(id), shared_bitmap_(bitmap.Pass()), free_(true), parent_(NULL) {}
 
 CompositorSoftwareOutputDevice::Buffer::~Buffer() {
 }
@@ -59,7 +58,8 @@ bool CompositorSoftwareOutputDevice::Buffer::FindDamageDifferenceFrom(
 CompositorSoftwareOutputDevice::CompositorSoftwareOutputDevice()
     : current_index_(-1),
       next_buffer_id_(1),
-      render_thread_(RenderThread::Get()) {
+      shared_bitmap_manager_(
+          RenderThreadImpl::current()->shared_bitmap_manager()) {
   DetachFromThread();
 }
 
@@ -77,13 +77,10 @@ unsigned CompositorSoftwareOutputDevice::GetNextId() {
 
 CompositorSoftwareOutputDevice::Buffer*
 CompositorSoftwareOutputDevice::CreateBuffer() {
-  const size_t size = 4 * viewport_size_.GetArea();
-  scoped_ptr<base::SharedMemory> mem =
-      render_thread_->HostAllocateSharedMemoryBuffer(size).Pass();
-  CHECK(mem);
-  bool success = mem->Map(size);
-  CHECK(success);
-  return new Buffer(GetNextId(), mem.Pass());
+  scoped_ptr<cc::SharedBitmap> shared_bitmap =
+      shared_bitmap_manager_->AllocateSharedBitmap(viewport_size_);
+  CHECK(shared_bitmap);
+  return new Buffer(GetNextId(), shared_bitmap.Pass());
 }
 
 size_t CompositorSoftwareOutputDevice::FindFreeBuffer(size_t hint) {
@@ -200,10 +197,7 @@ void CompositorSoftwareOutputDevice::EndPaint(
   frame_data->id = buffer->id();
   frame_data->size = viewport_size_;
   frame_data->damage_rect = damage_rect_;
-  frame_data->handle = buffer->handle();
-
-  CHECK_LE(static_cast<size_t>(frame_data->size.GetArea()) * 4,
-           buffer->shared_memory()->mapped_size());
+  frame_data->bitmap_id = buffer->shared_bitmap_id();
 }
 
 void CompositorSoftwareOutputDevice::ReclaimSoftwareFrame(unsigned id) {
diff --git a/content/renderer/gpu/compositor_software_output_device.h b/content/renderer/gpu/compositor_software_output_device.h
index 815cd96..646349a 100644
--- a/content/renderer/gpu/compositor_software_output_device.h
+++ b/content/renderer/gpu/compositor_software_output_device.h
@@ -10,11 +10,16 @@
 #include "base/memory/shared_memory.h"
 #include "base/threading/non_thread_safe.h"
 #include "cc/output/software_output_device.h"
+#include "cc/resources/shared_bitmap.h"
 #include "content/public/renderer/render_thread.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 class SkRegion;
 
+namespace cc {
+class SharedBitmapManager;
+}
+
 namespace content {
 
 // This class can be created only on the main thread, but then becomes pinned
@@ -42,14 +47,13 @@ private:
   // FindDamageDifferenceFrom).
   class Buffer {
    public:
-    explicit Buffer(unsigned id, scoped_ptr<base::SharedMemory> mem);
+    explicit Buffer(unsigned id, scoped_ptr<cc::SharedBitmap> bitmap);
     ~Buffer();
 
     unsigned id() const { return id_; }
 
-    void* memory() const { return mem_->memory(); }
-    base::SharedMemoryHandle handle() const { return mem_->handle(); }
-    base::SharedMemory* shared_memory() const { return mem_.get(); }
+    void* memory() const { return shared_bitmap_->pixels(); }
+    cc::SharedBitmapId shared_bitmap_id() const { return shared_bitmap_->id(); }
 
     bool free() const { return free_; }
     void SetFree(bool free) { free_ = free; }
@@ -61,7 +65,7 @@ private:
 
    private:
     const unsigned id_;
-    scoped_ptr<base::SharedMemory> mem_;
+    scoped_ptr<cc::SharedBitmap> shared_bitmap_;
     bool free_;
     Buffer* parent_;
     gfx::Rect damage_;
@@ -89,7 +93,7 @@ private:
   unsigned next_buffer_id_;
   ScopedVector<Buffer> buffers_;
   ScopedVector<Buffer> awaiting_ack_;
-  RenderThread* render_thread_;
+  cc::SharedBitmapManager* shared_bitmap_manager_;
 };
 
 }  // namespace content
diff --git a/content/renderer/render_frame_impl.cc b/content/renderer/render_frame_impl.cc
index a0ddeef..2d63fbc 100644
--- a/content/renderer/render_frame_impl.cc
+++ b/content/renderer/render_frame_impl.cc
@@ -897,7 +897,8 @@ void RenderFrameImpl::OnCompositorFrameSwapped(const IPC::Message& message) {
   compositing_helper_->OnCompositorFrameSwapped(frame.Pass(),
                                                 param.a.producing_route_id,
                                                 param.a.output_surface_id,
-                                                param.a.producing_host_id);
+                                                param.a.producing_host_id,
+                                                param.a.shared_memory_handle);
 }
 
 void RenderFrameImpl::OnContextMenuClosed(