linux: fix race in TransportDIB passing

There was a race condition when the renderer passes a TransportDIB to the plugin
process. It is possible that the renderer destroys the TransportDIB before the
plugin handles the message, in which case the plugin will fail to map the shm
handle.

This also cleans up a couple of things.

BUG=18320

Review URL: http://codereview.chromium.org/164226


git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22949 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 7 insertions, 1 deletions

diff --git a/chrome/plugin/webplugin_proxy.cc b/chrome/plugin/webplugin_proxy.cc
index 0e2e006..8a04650 100644
--- a/chrome/plugin/webplugin_proxy.cc
+++ b/chrome/plugin/webplugin_proxy.cc
@@ -636,7 +636,13 @@ void WebPluginProxy::SetWindowlessBuffer(
   int width = delegate_->GetRect().width();
   int height = delegate_->GetRect().height();
   windowless_dib_.reset(TransportDIB::Map(windowless_buffer));
-  windowless_canvas_.reset(windowless_dib_->GetPlatformCanvas(width, height));
+  if (windowless_dib_.get()) {
+    windowless_canvas_.reset(windowless_dib_->GetPlatformCanvas(width, height));
+  } else {
+    // This can happen if the renderer has already destroyed the TransportDIB
+    // by the time we receive the handle, e.g. in case of multiple resizes.
+    windowless_canvas_.reset();
+  }
   background_dib_.reset(TransportDIB::Map(background_buffer));
   if (background_dib_.get()) {
     background_canvas_.reset(background_dib_->GetPlatformCanvas(width, height));