On Windows, create a new TransportDIB::Handle struct which includes the file

mapping HANDLE and the source process ID. Duplicating the handle for the
remote process is done in TransportDIB::Map, instead of in various #ifdefs
scattered across the code. Also on windows, remove the struct for the
TransportDIB::Id which contained both the sequence number and the HANDLE and
replace it with just the sequence number.

Fix ThumbnailGenerator by mapping the TransportDIB on Windows and adding
a method to duplicate the file mapping handle before sending across the
channel.

Also, add a ScopedHandle and fix some handle leaks.
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/3834003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63232 0039d316-1c4b-4281-b951-d872f2087c98

26 files changed, 121 insertions, 93 deletions

diff --git a/chrome/browser/renderer_host/backing_store.h b/chrome/browser/renderer_host/backing_store.h
index 53d0288..4bcbd19 100644
--- a/chrome/browser/renderer_host/backing_store.h
+++ b/chrome/browser/renderer_host/backing_store.h
@@ -48,7 +48,8 @@ class BackingStore {
   // DonePaintingToBackingStore().
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id bitmap,
+      TransportDIB::Id dib_id,
+      TransportDIB::Handle dib_handle,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously) = 0;
diff --git a/chrome/browser/renderer_host/backing_store_mac.h b/chrome/browser/renderer_host/backing_store_mac.h
index 2c75400d..86671d6 100644
--- a/chrome/browser/renderer_host/backing_store_mac.h
+++ b/chrome/browser/renderer_host/backing_store_mac.h
@@ -26,7 +26,8 @@ class BackingStoreMac : public BackingStore {
   // BackingStore implementation.
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id bitmap,
+      TransportDIB::Id dib_id,
+      TransportDIB::Handle dib_handle,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_mac.mm b/chrome/browser/renderer_host/backing_store_mac.mm
index bea378f..318656c 100644
--- a/chrome/browser/renderer_host/backing_store_mac.mm
+++ b/chrome/browser/renderer_host/backing_store_mac.mm
@@ -54,7 +54,8 @@ BackingStoreMac::~BackingStoreMac() {
 
 void BackingStoreMac::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
@@ -64,7 +65,7 @@ void BackingStoreMac::PaintToBackingStore(
 
   DCHECK_NE(static_cast<bool>(cg_layer()), static_cast<bool>(cg_bitmap()));
 
-  TransportDIB* dib = process->GetTransportDIB(bitmap);
+  TransportDIB* dib = process->GetTransportDIB(dib_id, dib_handle);
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_manager.cc b/chrome/browser/renderer_host/backing_store_manager.cc
index 4325f31..745020f 100644
--- a/chrome/browser/renderer_host/backing_store_manager.cc
+++ b/chrome/browser/renderer_host/backing_store_manager.cc
@@ -193,7 +193,8 @@ BackingStore* BackingStoreManager::GetBackingStore(
 void BackingStoreManager::PrepareBackingStore(
     RenderWidgetHost* host,
     const gfx::Size& backing_store_size,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* needs_full_paint,
@@ -217,8 +218,11 @@ void BackingStoreManager::PrepareBackingStore(
     backing_store = CreateBackingStore(host, backing_store_size);
   }
 
-  backing_store->PaintToBackingStore(host->process(), bitmap,
-                                     bitmap_rect, copy_rects,
+  backing_store->PaintToBackingStore(host->process(),
+                                     dib_id,
+                                     dib_handle,
+                                     bitmap_rect,
+                                     copy_rects,
                                      painted_synchronously);
 }
 
diff --git a/chrome/browser/renderer_host/backing_store_manager.h b/chrome/browser/renderer_host/backing_store_manager.h
index 1ab78cc..48e7924 100644
--- a/chrome/browser/renderer_host/backing_store_manager.h
+++ b/chrome/browser/renderer_host/backing_store_manager.h
@@ -51,7 +51,8 @@ class BackingStoreManager {
   static void PrepareBackingStore(
       RenderWidgetHost* host,
       const gfx::Size& backing_store_size,
-      TransportDIB::Id bitmap,
+      TransportDIB::Id dib_id,
+      TransportDIB::Handle dib_handle,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* needs_full_paint,
diff --git a/chrome/browser/renderer_host/backing_store_proxy.cc b/chrome/browser/renderer_host/backing_store_proxy.cc
index 3d2fd8e..e5609e5 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.cc
+++ b/chrome/browser/renderer_host/backing_store_proxy.cc
@@ -12,10 +12,6 @@
 #include "chrome/common/render_messages.h"
 #include "gfx/rect.h"
 
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
 BackingStoreProxy::BackingStoreProxy(RenderWidgetHost* widget,
                                      const gfx::Size& size,
                                      GpuProcessHostUIShim* process_shim,
@@ -33,21 +29,16 @@ BackingStoreProxy::~BackingStoreProxy() {
 
 void BackingStoreProxy::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
   DCHECK(!waiting_for_paint_ack_);
-
-  base::ProcessId process_id;
-#if defined(OS_WIN)
-  process_id = ::GetProcessId(process->GetHandle());
-#elif defined(OS_POSIX)
-  process_id = process->GetHandle();
-#endif
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
 
   if (process_shim_->Send(new GpuMsg_PaintToBackingStore(
-          routing_id_, process_id, bitmap, bitmap_rect, copy_rects))) {
+          routing_id_, scoped_dib_handle.release(), bitmap_rect, copy_rects))) {
     // Message sent successfully, so the caller can not destroy the
     // TransportDIB. OnDonePaintingToBackingStore will free it later.
     *painted_synchronously = false;
diff --git a/chrome/browser/renderer_host/backing_store_proxy.h b/chrome/browser/renderer_host/backing_store_proxy.h
index 610f7ef..a9a3c3e 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.h
+++ b/chrome/browser/renderer_host/backing_store_proxy.h
@@ -21,7 +21,8 @@ class BackingStoreProxy : public BackingStore,
 
   // BackingStore implementation.
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id bitmap,
+                                   TransportDIB::Id dib_id,
+                                   TransportDIB::Handle dib_handle,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_win.cc b/chrome/browser/renderer_host/backing_store_win.cc
index 94d9cbf..b8385d3 100644
--- a/chrome/browser/renderer_host/backing_store_win.cc
+++ b/chrome/browser/renderer_host/backing_store_win.cc
@@ -69,7 +69,8 @@ void CallStretchDIBits(HDC hdc, int dest_x, int dest_y, int dest_w, int dest_h,
 
 }  // namespace
 
-BackingStoreWin::BackingStoreWin(RenderWidgetHost* widget, const gfx::Size& size)
+BackingStoreWin::BackingStoreWin(RenderWidgetHost* widget,
+                                 const gfx::Size& size)
     : BackingStore(widget, size),
       backing_store_dib_(NULL),
       original_bitmap_(NULL) {
@@ -114,10 +115,12 @@ size_t BackingStoreWin::MemorySize() {
 
 void BackingStoreWin::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   // Our paints are always synchronous and the TransportDIB can be freed when
   // we're done (even on error).
   *painted_synchronously = true;
@@ -132,7 +135,8 @@ void BackingStoreWin::PaintToBackingStore(
     original_bitmap_ = SelectObject(hdc_, backing_store_dib_);
   }
 
-  TransportDIB* dib = process->GetTransportDIB(bitmap);
+  TransportDIB* dib = process->GetTransportDIB(dib_id,
+                                               scoped_dib_handle.release());
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_win.h b/chrome/browser/renderer_host/backing_store_win.h
index 221e0aa..a99c835 100644
--- a/chrome/browser/renderer_host/backing_store_win.h
+++ b/chrome/browser/renderer_host/backing_store_win.h
@@ -24,7 +24,8 @@ class BackingStoreWin : public BackingStore {
   // BackingStore implementation.
   virtual size_t MemorySize();
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id bitmap,
+                                   TransportDIB::Id dib_id,
+                                   TransportDIB::Handle dib_handle,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_x.cc b/chrome/browser/renderer_host/backing_store_x.cc
index a79a8fc..34db658 100644
--- a/chrome/browser/renderer_host/backing_store_x.cc
+++ b/chrome/browser/renderer_host/backing_store_x.cc
@@ -158,10 +158,12 @@ void BackingStoreX::PaintRectWithoutXrender(
 
 void BackingStoreX::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   // Our paints are always synchronous and the caller can free the TransportDIB
   // when we're done, even on error.
   *painted_synchronously = true;
@@ -179,7 +181,8 @@ void BackingStoreX::PaintToBackingStore(
       height <= 0 || height > kMaxVideoLayerSize)
     return;
 
-  TransportDIB* dib = process->GetTransportDIB(bitmap);
+  TransportDIB* dib = process->GetTransportDIB(dib_id,
+                                               scoped_dib_handle.release());
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_x.h b/chrome/browser/renderer_host/backing_store_x.h
index 283c19f..2fce04f 100644
--- a/chrome/browser/renderer_host/backing_store_x.h
+++ b/chrome/browser/renderer_host/backing_store_x.h
@@ -51,7 +51,8 @@ class BackingStoreX : public BackingStore {
   virtual size_t MemorySize();
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id bitmap,
+      TransportDIB::Id dib_id,
+      TransportDIB::Handle dib_handle,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index 5e254e5..aed96e0 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -778,23 +778,20 @@ bool BrowserRenderProcessHost::SendWithTimeout(IPC::Message* msg,
 
 // This is a platform specific function for mapping a transport DIB given its id
 TransportDIB* BrowserRenderProcessHost::MapTransportDIB(
-    TransportDIB::Id dib_id) {
-#if defined(OS_WIN)
-  // On Windows we need to duplicate the handle from the remote process
-  HANDLE section = win_util::GetSectionFromProcess(
-      dib_id.handle, GetHandle(), false /* read write */);
-  return TransportDIB::Map(section);
-#elif defined(OS_MACOSX)
+    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
+  TransportDIB::ScopedHandle scoped_handle(dib_handle);
+#if defined(OS_MACOSX)
   // On OSX, the browser allocates all DIBs and keeps a file descriptor around
   // for each.
   return widget_helper_->MapTransportDIB(dib_id);
-#elif defined(OS_POSIX)
-  return TransportDIB::Map(dib_id);
-#endif  // defined(OS_POSIX)
+#else
+  return TransportDIB::Map(scoped_handle.release());
+#endif
 }
 
 TransportDIB* BrowserRenderProcessHost::GetTransportDIB(
-    TransportDIB::Id dib_id) {
+    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
+  TransportDIB::ScopedHandle scoped_handle(dib_handle);
   const std::map<TransportDIB::Id, TransportDIB*>::iterator
       i = cached_dibs_.find(dib_id);
   if (i != cached_dibs_.end()) {
@@ -802,7 +799,7 @@ TransportDIB* BrowserRenderProcessHost::GetTransportDIB(
     return i->second;
   }
 
-  TransportDIB* dib = MapTransportDIB(dib_id);
+  TransportDIB* dib = MapTransportDIB(dib_id, scoped_handle.release());
   if (!dib)
     return NULL;
 
diff --git a/chrome/browser/renderer_host/browser_render_process_host.h b/chrome/browser/renderer_host/browser_render_process_host.h
index 9983c84..16a5cac 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.h
+++ b/chrome/browser/renderer_host/browser_render_process_host.h
@@ -78,7 +78,8 @@ class BrowserRenderProcessHost : public RenderProcessHost,
   virtual bool FastShutdownIfPossible();
   virtual bool SendWithTimeout(IPC::Message* msg, int timeout_ms);
   virtual base::ProcessHandle GetHandle();
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id);
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
+                                        TransportDIB::Handle dib_handle);
 
   // IPC::Channel::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg);
@@ -185,8 +186,10 @@ class BrowserRenderProcessHost : public RenderProcessHost,
     MAX_MAPPED_TRANSPORT_DIBS = 3,
   };
 
-  // Map a transport DIB from its Id and return it. Returns NULL on error.
-  TransportDIB* MapTransportDIB(TransportDIB::Id dib_id);
+  // Map a transport DIB from its handle. On Mac, the ID is necessary to find
+  // the appropriate file descriptor. Returns NULL on error.
+  TransportDIB* MapTransportDIB(TransportDIB::Id dib_id,
+                                TransportDIB::Handle dib_handle);
 
   void ClearTransportDIBCache();
   // This is used to clear our cache five seconds after the last use.
diff --git a/chrome/browser/renderer_host/mock_render_process_host.cc b/chrome/browser/renderer_host/mock_render_process_host.cc
index a2ccfa0..e39d5b7 100644
--- a/chrome/browser/renderer_host/mock_render_process_host.cc
+++ b/chrome/browser/renderer_host/mock_render_process_host.cc
@@ -98,20 +98,17 @@ bool MockRenderProcessHost::Send(IPC::Message* msg) {
   return true;
 }
 
-TransportDIB* MockRenderProcessHost::GetTransportDIB(TransportDIB::Id dib_id) {
+TransportDIB* MockRenderProcessHost::GetTransportDIB(
+    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   if (transport_dib_)
     return transport_dib_;
-#if defined(OS_WIN)
-  HANDLE duped;
-  DuplicateHandle(GetCurrentProcess(), dib_id.handle, GetCurrentProcess(),
-                  &duped, 0, TRUE, DUPLICATE_SAME_ACCESS);
-  transport_dib_ = TransportDIB::Map(duped);
-#elif defined(OS_MACOSX)
+#if defined(OS_MACOSX)
   // On Mac, TransportDIBs are always created in the browser, so we cannot map
   // one from a dib_id.
   transport_dib_ = TransportDIB::Create(100 * 100 * 4, 0);
-#elif defined(OS_POSIX)
-  transport_dib_ = TransportDIB::Map(dib_id);
+#else
+  transport_dib_ = TransportDIB::Map(scoped_dib_handle.release());
 #endif
 
   return transport_dib_;
diff --git a/chrome/browser/renderer_host/mock_render_process_host.h b/chrome/browser/renderer_host/mock_render_process_host.h
index 232725b..494a45c 100644
--- a/chrome/browser/renderer_host/mock_render_process_host.h
+++ b/chrome/browser/renderer_host/mock_render_process_host.h
@@ -53,7 +53,8 @@ class MockRenderProcessHost : public RenderProcessHost {
   virtual bool SendWithTimeout(IPC::Message* msg, int timeout_ms);
   virtual base::ProcessHandle GetHandle();
 
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id);
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
+                                        TransportDIB::Handle dib_handle);
 
   // IPC::Channel::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg);
diff --git a/chrome/browser/renderer_host/render_process_host.h b/chrome/browser/renderer_host/render_process_host.h
index a5fd378..38cb5f2 100644
--- a/chrome/browser/renderer_host/render_process_host.h
+++ b/chrome/browser/renderer_host/render_process_host.h
@@ -216,12 +216,12 @@ class RenderProcessHost : public IPC::Channel::Sender,
 
   // Transport DIB functions ---------------------------------------------------
 
-  // Return the TransportDIB for the given id. On Linux, this can involve
-  // mapping shared memory. On Mac, the shared memory is created in the browser
-  // process and the cached metadata is returned. On Windows, this involves
-  // duplicating the handle from the remote process.  The RenderProcessHost
-  // still owns the returned DIB.
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) = 0;
+  // Return the TransportDIB for the given id. On Windows and Linux, this may
+  // involve mapping the TransportDIB. On Mac, the shared memory is created in
+  // the browser process and the cached metadata is returned. The
+  // RenderProcessHost still owns the returned DIB.
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
+                                        TransportDIB::Handle dib_handle) = 0;
 
   // Static management functions -----------------------------------------------
 
diff --git a/chrome/browser/renderer_host/render_widget_host.cc b/chrome/browser/renderer_host/render_widget_host.cc
index a6efd58..bf98b7d 100644
--- a/chrome/browser/renderer_host/render_widget_host.cc
+++ b/chrome/browser/renderer_host/render_widget_host.cc
@@ -763,6 +763,7 @@ void RenderWidgetHost::OnMsgPaintAtSizeAck(int tag, const gfx::Size& size) {
 
 void RenderWidgetHost::OnMsgUpdateRect(
     const ViewHostMsg_UpdateRect_Params& params) {
+  TransportDIB::ScopedHandle dib_handle(params.dib_handle);
   TimeTicks paint_start = TimeTicks::Now();
 
   if (paint_observer_.get())
@@ -797,7 +798,8 @@ void RenderWidgetHost::OnMsgUpdateRect(
   if (!is_gpu_rendering_active_) {
     const size_t size = params.bitmap_rect.height() *
         params.bitmap_rect.width() * 4;
-    TransportDIB* dib = process_->GetTransportDIB(params.bitmap);
+    TransportDIB* dib = process_->GetTransportDIB(params.dib_id,
+                                                  dib_handle.release());
 
     // If gpu process does painting, scroll_rect and copy_rects are always empty
     // and backing store is never used.
@@ -816,8 +818,11 @@ void RenderWidgetHost::OnMsgUpdateRect(
         // Paint the backing store. This will update it with the
         // renderer-supplied bits. The view will read out of the backing store
         // later to actually draw to the screen.
-        PaintBackingStoreRect(params.bitmap, params.bitmap_rect,
-                              params.copy_rects, params.view_size,
+        PaintBackingStoreRect(params.dib_id,
+                              params.dib_handle,
+                              params.bitmap_rect,
+                              params.copy_rects,
+                              params.view_size,
                               &painted_synchronously);
       }
     }
@@ -881,9 +886,10 @@ void RenderWidgetHost::OnMsgCreateVideo(const gfx::Size& size) {
   Send(new ViewMsg_CreateVideo_ACK(routing_id_, -1));
 }
 
-void RenderWidgetHost::OnMsgUpdateVideo(TransportDIB::Id bitmap,
+void RenderWidgetHost::OnMsgUpdateVideo(TransportDIB::Id dib_id,
+                                        TransportDIB::Handle dib_handle,
                                         const gfx::Rect& bitmap_rect) {
-  PaintVideoLayer(bitmap, bitmap_rect);
+  PaintVideoLayer(dib_id, dib_handle, bitmap_rect);
 
   // TODO(scherkus): support actual video ids!
   Send(new ViewMsg_UpdateVideo_ACK(routing_id_, -1));
@@ -1049,9 +1055,10 @@ void RenderWidgetHost::OnAcceleratedSurfaceSetTransportDIB(
     int32 width,
     int32 height,
     TransportDIB::Handle transport_dib) {
+  TransportDIB::ScopedHandle scoped_dib_handle(transport_dib);
   if (view_) {
     view_->AcceleratedSurfaceSetTransportDIB(window, width, height,
-                                             transport_dib);
+                                             scoped_dib_handle.release());
   }
 }
 
@@ -1085,7 +1092,8 @@ void RenderWidgetHost::OnMsgDestroyPluginContainer(gfx::PluginWindowHandle id) {
 #endif
 
 void RenderWidgetHost::PaintBackingStoreRect(
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     const gfx::Size& view_size,
@@ -1107,8 +1115,13 @@ void RenderWidgetHost::PaintBackingStoreRect(
   }
 
   bool needs_full_paint = false;
-  BackingStoreManager::PrepareBackingStore(this, view_size, bitmap, bitmap_rect,
-                                           copy_rects, &needs_full_paint,
+  BackingStoreManager::PrepareBackingStore(this,
+                                           view_size,
+                                           dib_id,
+                                           dib_handle,
+                                           bitmap_rect,
+                                           copy_rects,
+                                           &needs_full_paint,
                                            painted_synchronously);
   if (needs_full_paint) {
     repaint_start_time_ = TimeTicks::Now();
@@ -1137,12 +1150,13 @@ void RenderWidgetHost::ScrollBackingStoreRect(int dx, int dy,
   backing_store->ScrollBackingStore(dx, dy, clip_rect, view_size);
 }
 
-void RenderWidgetHost::PaintVideoLayer(TransportDIB::Id bitmap,
+void RenderWidgetHost::PaintVideoLayer(TransportDIB::Id dib_id,
+                                       TransportDIB::Handle dib_handle,
                                        const gfx::Rect& bitmap_rect) {
   if (is_hidden_ || !video_layer_.get())
     return;
 
-  video_layer_->CopyTransportDIB(process(), bitmap, bitmap_rect);
+  video_layer_->CopyTransportDIB(process(), dib_id, dib_handle, bitmap_rect);
 
   // Don't update the view if we're hidden or if the view has been destroyed.
   if (is_hidden_ || !view_)
diff --git a/chrome/browser/renderer_host/render_widget_host.h b/chrome/browser/renderer_host/render_widget_host.h
index 6c3fed7..26d1c2c 100644
--- a/chrome/browser/renderer_host/render_widget_host.h
+++ b/chrome/browser/renderer_host/render_widget_host.h
@@ -480,7 +480,9 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   void OnMsgPaintAtSizeAck(int tag, const gfx::Size& size);
   void OnMsgUpdateRect(const ViewHostMsg_UpdateRect_Params& params);
   void OnMsgCreateVideo(const gfx::Size& size);
-  void OnMsgUpdateVideo(TransportDIB::Id bitmap, const gfx::Rect& bitmap_rect);
+  void OnMsgUpdateVideo(TransportDIB::Id dib_id,
+                        TransportDIB::Handle dib_handle,
+                        const gfx::Rect& bitmap_rect);
   void OnMsgDestroyVideo();
   void OnMsgInputEventAck(const IPC::Message& message);
   virtual void OnMsgFocus();
@@ -523,7 +525,8 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   // synchronously, and the bitmap is done being used. False means that the
   // backing store will paint the bitmap at a later time and that the DIB can't
   // be freed (it will be the backing store's job to free it later).
-  void PaintBackingStoreRect(TransportDIB::Id bitmap,
+  void PaintBackingStoreRect(TransportDIB::Id dib_id,
+                             TransportDIB::Handle dib_handle,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects,
                              const gfx::Size& view_size,
@@ -538,7 +541,8 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   // Paints the entire given bitmap into the current video layer, if it exists.
   // |bitmap_rect| specifies the destination size and absolute location of the
   // bitmap on the backing store.
-  void PaintVideoLayer(TransportDIB::Id bitmap,
+  void PaintVideoLayer(TransportDIB::Id dib_id,
+                       TransportDIB::Handle dib_handle,
                        const gfx::Rect& bitmap_rect);
 
   // Called by OnMsgInputEventAck() to process a keyboard event ack message.
diff --git a/chrome/browser/renderer_host/render_widget_host_unittest.cc b/chrome/browser/renderer_host/render_widget_host_unittest.cc
index 1c5bb17..02b3bd8 100644
--- a/chrome/browser/renderer_host/render_widget_host_unittest.cc
+++ b/chrome/browser/renderer_host/render_widget_host_unittest.cc
@@ -84,7 +84,8 @@ void RenderWidgetHostProcess::InitUpdateRectParams(
 
   if (!current_update_buf_)
     current_update_buf_ = TransportDIB::Create(pixel_size, 0);
-  params->bitmap = current_update_buf_->id();
+  params->dib_id = current_update_buf_->id();
+  params->dib_handle = current_update_buf_->handle();
   params->bitmap_rect = gfx::Rect(0, 0, w, h);
   params->dx = 0;
   params->dy = 0;
diff --git a/chrome/browser/renderer_host/test/test_backing_store.cc b/chrome/browser/renderer_host/test/test_backing_store.cc
index d90c7fd..01dc7d8 100644
--- a/chrome/browser/renderer_host/test/test_backing_store.cc
+++ b/chrome/browser/renderer_host/test/test_backing_store.cc
@@ -14,7 +14,8 @@ TestBackingStore::~TestBackingStore() {
 
 void TestBackingStore::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id bitmap,
+    TransportDIB::Id dib_id,
+    TransportDIB::Handle dib_handle,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
diff --git a/chrome/browser/renderer_host/test/test_backing_store.h b/chrome/browser/renderer_host/test/test_backing_store.h
index f9db76e..d532dc1 100644
--- a/chrome/browser/renderer_host/test/test_backing_store.h
+++ b/chrome/browser/renderer_host/test/test_backing_store.h
@@ -16,7 +16,8 @@ class TestBackingStore : public BackingStore {
 
   // BackingStore implementation.
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id bitmap,
+                                   TransportDIB::Id dib_id,
+                                   TransportDIB::Handle dib_handle,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/video_layer.h b/chrome/browser/renderer_host/video_layer.h
index 0d7d4f8..4bcc245 100644
--- a/chrome/browser/renderer_host/video_layer.h
+++ b/chrome/browser/renderer_host/video_layer.h
@@ -26,12 +26,13 @@ class VideoLayer {
   RenderWidgetHost* render_widget_host() const { return render_widget_host_; }
   const gfx::Size& size() { return size_; }
 
-  // Copy the incoming bitmap into this video layer. |bitmap| contains YUV
+  // Copy the incoming bitmap into this video layer. The given DIB contains YUV
   // pixel data in YV12 format and must be the same dimensions as this video
   // layer. |bitmap_rect| specifies the absolute position and destination size
   // of the bitmap on the backing store.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id bitmap,
+                                TransportDIB::Id dib_id,
+                                TransportDIB::Handle dib_handle,
                                 const gfx::Rect& bitmap_rect) = 0;
 
  protected:
diff --git a/chrome/browser/renderer_host/video_layer_proxy.cc b/chrome/browser/renderer_host/video_layer_proxy.cc
index 3df1d25..fb4cfe9 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.cc
+++ b/chrome/browser/renderer_host/video_layer_proxy.cc
@@ -5,7 +5,6 @@
 #include "chrome/browser/renderer_host/video_layer_proxy.h"
 
 #include "chrome/browser/gpu_process_host_ui_shim.h"
-#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/common/gpu_messages.h"
 #include "gfx/rect.h"
 
@@ -24,17 +23,12 @@ VideoLayerProxy::~VideoLayerProxy() {
 }
 
 void VideoLayerProxy::CopyTransportDIB(RenderProcessHost* process,
-                                       TransportDIB::Id bitmap,
+                                       TransportDIB::Id dib_id,
+                                       TransportDIB::Handle dib_handle,
                                        const gfx::Rect& bitmap_rect) {
-  base::ProcessId process_id;
-#if defined(OS_WIN)
-  process_id = ::GetProcessId(process->GetHandle());
-#elif defined(OS_POSIX)
-  process_id = process->GetHandle();
-#endif
-
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   if (process_shim_->Send(new GpuMsg_PaintToVideoLayer(
-          routing_id_, process_id, bitmap, bitmap_rect))) {
+          routing_id_, scoped_dib_handle.release(), bitmap_rect))) {
   } else {
     // TODO(scherkus): what to do ?!?!
   }
diff --git a/chrome/browser/renderer_host/video_layer_proxy.h b/chrome/browser/renderer_host/video_layer_proxy.h
index 4a4cc71..4d3b1f2f 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.h
+++ b/chrome/browser/renderer_host/video_layer_proxy.h
@@ -20,7 +20,8 @@ class VideoLayerProxy : public VideoLayer, public IPC::Channel::Listener {
 
   // VideoLayer implementation.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id bitmap,
+                                TransportDIB::Id dib_id,
+                                TransportDIB::Handle dib_handle,
                                 const gfx::Rect& bitmap_rect);
 
   // IPC::Channel::Listener implementation.
diff --git a/chrome/browser/renderer_host/video_layer_x.cc b/chrome/browser/renderer_host/video_layer_x.cc
index 09891b3..a8a878b 100644
--- a/chrome/browser/renderer_host/video_layer_x.cc
+++ b/chrome/browser/renderer_host/video_layer_x.cc
@@ -44,8 +44,10 @@ VideoLayerX::~VideoLayerX() {
 }
 
 void VideoLayerX::CopyTransportDIB(RenderProcessHost* process,
-                                   TransportDIB::Id bitmap,
+                                   TransportDIB::Id dib_id,
+                                   TransportDIB::Handle dib_handle,
                                    const gfx::Rect& bitmap_rect) {
+  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   if (!display_)
     return;
 
@@ -76,7 +78,8 @@ void VideoLayerX::CopyTransportDIB(RenderProcessHost* process,
     rgb_frame_size_ = new_rgb_frame_size;
   }
 
-  TransportDIB* dib = process->GetTransportDIB(bitmap);
+  TransportDIB* dib = process->GetTransportDIB(dib_id,
+                                               scoped_dib_handle.release());
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/video_layer_x.h b/chrome/browser/renderer_host/video_layer_x.h
index a12c7b4..8c3a66f 100644
--- a/chrome/browser/renderer_host/video_layer_x.h
+++ b/chrome/browser/renderer_host/video_layer_x.h
@@ -20,7 +20,8 @@ class VideoLayerX : public VideoLayer {
 
   // VideoLayer implementation.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id bitmap,
+                                TransportDIB::Id dib_id,
+                                TransportDIB::Handle dib_handle,
                                 const gfx::Rect& bitmap_rect);
 
   // Copy from the server-side video layer to the target window.