Revert 63232 - On Windows, create a new TransportDIB::Handle struct which includes the file

mapping HANDLE and the source process ID. Duplicating the handle for the
remote process is done in TransportDIB::Map, instead of in various #ifdefs
scattered across the code. Also on windows, remove the struct for the
TransportDIB::Id which contained both the sequence number and the HANDLE and
replace it with just the sequence number.

Fix ThumbnailGenerator by mapping the TransportDIB on Windows and adding
a method to duplicate the file mapping handle before sending across the
channel.

Also, add a ScopedHandle and fix some handle leaks.
BUG=none
TEST=none

Review URL: http://codereview.chromium.org/3834003

TBR=kkania@chromium.org
Review URL: http://codereview.chromium.org/3943002

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@63246 0039d316-1c4b-4281-b951-d872f2087c98

44 files changed, 240 insertions, 244 deletions

diff --git a/chrome/browser/renderer_host/backing_store.h b/chrome/browser/renderer_host/backing_store.h
index 4bcbd19..53d0288 100644
--- a/chrome/browser/renderer_host/backing_store.h
+++ b/chrome/browser/renderer_host/backing_store.h
@@ -48,8 +48,7 @@ class BackingStore {
   // DonePaintingToBackingStore().
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id dib_id,
-      TransportDIB::Handle dib_handle,
+      TransportDIB::Id bitmap,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously) = 0;
diff --git a/chrome/browser/renderer_host/backing_store_mac.h b/chrome/browser/renderer_host/backing_store_mac.h
index 86671d6..2c75400d 100644
--- a/chrome/browser/renderer_host/backing_store_mac.h
+++ b/chrome/browser/renderer_host/backing_store_mac.h
@@ -26,8 +26,7 @@ class BackingStoreMac : public BackingStore {
   // BackingStore implementation.
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id dib_id,
-      TransportDIB::Handle dib_handle,
+      TransportDIB::Id bitmap,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_mac.mm b/chrome/browser/renderer_host/backing_store_mac.mm
index 318656c..bea378f 100644
--- a/chrome/browser/renderer_host/backing_store_mac.mm
+++ b/chrome/browser/renderer_host/backing_store_mac.mm
@@ -54,8 +54,7 @@ BackingStoreMac::~BackingStoreMac() {
 
 void BackingStoreMac::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
@@ -65,7 +64,7 @@ void BackingStoreMac::PaintToBackingStore(
 
   DCHECK_NE(static_cast<bool>(cg_layer()), static_cast<bool>(cg_bitmap()));
 
-  TransportDIB* dib = process->GetTransportDIB(dib_id, dib_handle);
+  TransportDIB* dib = process->GetTransportDIB(bitmap);
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_manager.cc b/chrome/browser/renderer_host/backing_store_manager.cc
index 745020f..4325f31 100644
--- a/chrome/browser/renderer_host/backing_store_manager.cc
+++ b/chrome/browser/renderer_host/backing_store_manager.cc
@@ -193,8 +193,7 @@ BackingStore* BackingStoreManager::GetBackingStore(
 void BackingStoreManager::PrepareBackingStore(
     RenderWidgetHost* host,
     const gfx::Size& backing_store_size,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* needs_full_paint,
@@ -218,11 +217,8 @@ void BackingStoreManager::PrepareBackingStore(
     backing_store = CreateBackingStore(host, backing_store_size);
   }
 
-  backing_store->PaintToBackingStore(host->process(),
-                                     dib_id,
-                                     dib_handle,
-                                     bitmap_rect,
-                                     copy_rects,
+  backing_store->PaintToBackingStore(host->process(), bitmap,
+                                     bitmap_rect, copy_rects,
                                      painted_synchronously);
 }
 
diff --git a/chrome/browser/renderer_host/backing_store_manager.h b/chrome/browser/renderer_host/backing_store_manager.h
index 48e7924..1ab78cc 100644
--- a/chrome/browser/renderer_host/backing_store_manager.h
+++ b/chrome/browser/renderer_host/backing_store_manager.h
@@ -51,8 +51,7 @@ class BackingStoreManager {
   static void PrepareBackingStore(
       RenderWidgetHost* host,
       const gfx::Size& backing_store_size,
-      TransportDIB::Id dib_id,
-      TransportDIB::Handle dib_handle,
+      TransportDIB::Id bitmap,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* needs_full_paint,
diff --git a/chrome/browser/renderer_host/backing_store_proxy.cc b/chrome/browser/renderer_host/backing_store_proxy.cc
index e5609e5..3d2fd8e 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.cc
+++ b/chrome/browser/renderer_host/backing_store_proxy.cc
@@ -12,6 +12,10 @@
 #include "chrome/common/render_messages.h"
 #include "gfx/rect.h"
 
+#if defined(OS_WIN)
+#include <windows.h>
+#endif
+
 BackingStoreProxy::BackingStoreProxy(RenderWidgetHost* widget,
                                      const gfx::Size& size,
                                      GpuProcessHostUIShim* process_shim,
@@ -29,16 +33,21 @@ BackingStoreProxy::~BackingStoreProxy() {
 
 void BackingStoreProxy::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
   DCHECK(!waiting_for_paint_ack_);
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
+
+  base::ProcessId process_id;
+#if defined(OS_WIN)
+  process_id = ::GetProcessId(process->GetHandle());
+#elif defined(OS_POSIX)
+  process_id = process->GetHandle();
+#endif
 
   if (process_shim_->Send(new GpuMsg_PaintToBackingStore(
-          routing_id_, scoped_dib_handle.release(), bitmap_rect, copy_rects))) {
+          routing_id_, process_id, bitmap, bitmap_rect, copy_rects))) {
     // Message sent successfully, so the caller can not destroy the
     // TransportDIB. OnDonePaintingToBackingStore will free it later.
     *painted_synchronously = false;
diff --git a/chrome/browser/renderer_host/backing_store_proxy.h b/chrome/browser/renderer_host/backing_store_proxy.h
index a9a3c3e..610f7ef 100644
--- a/chrome/browser/renderer_host/backing_store_proxy.h
+++ b/chrome/browser/renderer_host/backing_store_proxy.h
@@ -21,8 +21,7 @@ class BackingStoreProxy : public BackingStore,
 
   // BackingStore implementation.
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id dib_id,
-                                   TransportDIB::Handle dib_handle,
+                                   TransportDIB::Id bitmap,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_win.cc b/chrome/browser/renderer_host/backing_store_win.cc
index b8385d3..94d9cbf 100644
--- a/chrome/browser/renderer_host/backing_store_win.cc
+++ b/chrome/browser/renderer_host/backing_store_win.cc
@@ -69,8 +69,7 @@ void CallStretchDIBits(HDC hdc, int dest_x, int dest_y, int dest_w, int dest_h,
 
 }  // namespace
 
-BackingStoreWin::BackingStoreWin(RenderWidgetHost* widget,
-                                 const gfx::Size& size)
+BackingStoreWin::BackingStoreWin(RenderWidgetHost* widget, const gfx::Size& size)
     : BackingStore(widget, size),
       backing_store_dib_(NULL),
       original_bitmap_(NULL) {
@@ -115,12 +114,10 @@ size_t BackingStoreWin::MemorySize() {
 
 void BackingStoreWin::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   // Our paints are always synchronous and the TransportDIB can be freed when
   // we're done (even on error).
   *painted_synchronously = true;
@@ -135,8 +132,7 @@ void BackingStoreWin::PaintToBackingStore(
     original_bitmap_ = SelectObject(hdc_, backing_store_dib_);
   }
 
-  TransportDIB* dib = process->GetTransportDIB(dib_id,
-                                               scoped_dib_handle.release());
+  TransportDIB* dib = process->GetTransportDIB(bitmap);
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_win.h b/chrome/browser/renderer_host/backing_store_win.h
index a99c835..221e0aa 100644
--- a/chrome/browser/renderer_host/backing_store_win.h
+++ b/chrome/browser/renderer_host/backing_store_win.h
@@ -24,8 +24,7 @@ class BackingStoreWin : public BackingStore {
   // BackingStore implementation.
   virtual size_t MemorySize();
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id dib_id,
-                                   TransportDIB::Handle dib_handle,
+                                   TransportDIB::Id bitmap,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/backing_store_x.cc b/chrome/browser/renderer_host/backing_store_x.cc
index 34db658..a79a8fc 100644
--- a/chrome/browser/renderer_host/backing_store_x.cc
+++ b/chrome/browser/renderer_host/backing_store_x.cc
@@ -158,12 +158,10 @@ void BackingStoreX::PaintRectWithoutXrender(
 
 void BackingStoreX::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   // Our paints are always synchronous and the caller can free the TransportDIB
   // when we're done, even on error.
   *painted_synchronously = true;
@@ -181,8 +179,7 @@ void BackingStoreX::PaintToBackingStore(
       height <= 0 || height > kMaxVideoLayerSize)
     return;
 
-  TransportDIB* dib = process->GetTransportDIB(dib_id,
-                                               scoped_dib_handle.release());
+  TransportDIB* dib = process->GetTransportDIB(bitmap);
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/backing_store_x.h b/chrome/browser/renderer_host/backing_store_x.h
index 2fce04f..283c19f 100644
--- a/chrome/browser/renderer_host/backing_store_x.h
+++ b/chrome/browser/renderer_host/backing_store_x.h
@@ -51,8 +51,7 @@ class BackingStoreX : public BackingStore {
   virtual size_t MemorySize();
   virtual void PaintToBackingStore(
       RenderProcessHost* process,
-      TransportDIB::Id dib_id,
-      TransportDIB::Handle dib_handle,
+      TransportDIB::Id bitmap,
       const gfx::Rect& bitmap_rect,
       const std::vector<gfx::Rect>& copy_rects,
       bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/browser_render_process_host.cc b/chrome/browser/renderer_host/browser_render_process_host.cc
index aed96e0..5e254e5 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.cc
+++ b/chrome/browser/renderer_host/browser_render_process_host.cc
@@ -778,20 +778,23 @@ bool BrowserRenderProcessHost::SendWithTimeout(IPC::Message* msg,
 
 // This is a platform specific function for mapping a transport DIB given its id
 TransportDIB* BrowserRenderProcessHost::MapTransportDIB(
-    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
-  TransportDIB::ScopedHandle scoped_handle(dib_handle);
-#if defined(OS_MACOSX)
+    TransportDIB::Id dib_id) {
+#if defined(OS_WIN)
+  // On Windows we need to duplicate the handle from the remote process
+  HANDLE section = win_util::GetSectionFromProcess(
+      dib_id.handle, GetHandle(), false /* read write */);
+  return TransportDIB::Map(section);
+#elif defined(OS_MACOSX)
   // On OSX, the browser allocates all DIBs and keeps a file descriptor around
   // for each.
   return widget_helper_->MapTransportDIB(dib_id);
-#else
-  return TransportDIB::Map(scoped_handle.release());
-#endif
+#elif defined(OS_POSIX)
+  return TransportDIB::Map(dib_id);
+#endif  // defined(OS_POSIX)
 }
 
 TransportDIB* BrowserRenderProcessHost::GetTransportDIB(
-    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
-  TransportDIB::ScopedHandle scoped_handle(dib_handle);
+    TransportDIB::Id dib_id) {
   const std::map<TransportDIB::Id, TransportDIB*>::iterator
       i = cached_dibs_.find(dib_id);
   if (i != cached_dibs_.end()) {
@@ -799,7 +802,7 @@ TransportDIB* BrowserRenderProcessHost::GetTransportDIB(
     return i->second;
   }
 
-  TransportDIB* dib = MapTransportDIB(dib_id, scoped_handle.release());
+  TransportDIB* dib = MapTransportDIB(dib_id);
   if (!dib)
     return NULL;
 
diff --git a/chrome/browser/renderer_host/browser_render_process_host.h b/chrome/browser/renderer_host/browser_render_process_host.h
index 16a5cac..9983c84 100644
--- a/chrome/browser/renderer_host/browser_render_process_host.h
+++ b/chrome/browser/renderer_host/browser_render_process_host.h
@@ -78,8 +78,7 @@ class BrowserRenderProcessHost : public RenderProcessHost,
   virtual bool FastShutdownIfPossible();
   virtual bool SendWithTimeout(IPC::Message* msg, int timeout_ms);
   virtual base::ProcessHandle GetHandle();
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
-                                        TransportDIB::Handle dib_handle);
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id);
 
   // IPC::Channel::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg);
@@ -186,10 +185,8 @@ class BrowserRenderProcessHost : public RenderProcessHost,
     MAX_MAPPED_TRANSPORT_DIBS = 3,
   };
 
-  // Map a transport DIB from its handle. On Mac, the ID is necessary to find
-  // the appropriate file descriptor. Returns NULL on error.
-  TransportDIB* MapTransportDIB(TransportDIB::Id dib_id,
-                                TransportDIB::Handle dib_handle);
+  // Map a transport DIB from its Id and return it. Returns NULL on error.
+  TransportDIB* MapTransportDIB(TransportDIB::Id dib_id);
 
   void ClearTransportDIBCache();
   // This is used to clear our cache five seconds after the last use.
diff --git a/chrome/browser/renderer_host/mock_render_process_host.cc b/chrome/browser/renderer_host/mock_render_process_host.cc
index e39d5b7..a2ccfa0 100644
--- a/chrome/browser/renderer_host/mock_render_process_host.cc
+++ b/chrome/browser/renderer_host/mock_render_process_host.cc
@@ -98,17 +98,20 @@ bool MockRenderProcessHost::Send(IPC::Message* msg) {
   return true;
 }
 
-TransportDIB* MockRenderProcessHost::GetTransportDIB(
-    TransportDIB::Id dib_id, TransportDIB::Handle dib_handle) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
+TransportDIB* MockRenderProcessHost::GetTransportDIB(TransportDIB::Id dib_id) {
   if (transport_dib_)
     return transport_dib_;
-#if defined(OS_MACOSX)
+#if defined(OS_WIN)
+  HANDLE duped;
+  DuplicateHandle(GetCurrentProcess(), dib_id.handle, GetCurrentProcess(),
+                  &duped, 0, TRUE, DUPLICATE_SAME_ACCESS);
+  transport_dib_ = TransportDIB::Map(duped);
+#elif defined(OS_MACOSX)
   // On Mac, TransportDIBs are always created in the browser, so we cannot map
   // one from a dib_id.
   transport_dib_ = TransportDIB::Create(100 * 100 * 4, 0);
-#else
-  transport_dib_ = TransportDIB::Map(scoped_dib_handle.release());
+#elif defined(OS_POSIX)
+  transport_dib_ = TransportDIB::Map(dib_id);
 #endif
 
   return transport_dib_;
diff --git a/chrome/browser/renderer_host/mock_render_process_host.h b/chrome/browser/renderer_host/mock_render_process_host.h
index 494a45c..232725b 100644
--- a/chrome/browser/renderer_host/mock_render_process_host.h
+++ b/chrome/browser/renderer_host/mock_render_process_host.h
@@ -53,8 +53,7 @@ class MockRenderProcessHost : public RenderProcessHost {
   virtual bool SendWithTimeout(IPC::Message* msg, int timeout_ms);
   virtual base::ProcessHandle GetHandle();
 
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
-                                        TransportDIB::Handle dib_handle);
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id);
 
   // IPC::Channel::Sender via RenderProcessHost.
   virtual bool Send(IPC::Message* msg);
diff --git a/chrome/browser/renderer_host/render_process_host.h b/chrome/browser/renderer_host/render_process_host.h
index 38cb5f2..a5fd378 100644
--- a/chrome/browser/renderer_host/render_process_host.h
+++ b/chrome/browser/renderer_host/render_process_host.h
@@ -216,12 +216,12 @@ class RenderProcessHost : public IPC::Channel::Sender,
 
   // Transport DIB functions ---------------------------------------------------
 
-  // Return the TransportDIB for the given id. On Windows and Linux, this may
-  // involve mapping the TransportDIB. On Mac, the shared memory is created in
-  // the browser process and the cached metadata is returned. The
-  // RenderProcessHost still owns the returned DIB.
-  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id,
-                                        TransportDIB::Handle dib_handle) = 0;
+  // Return the TransportDIB for the given id. On Linux, this can involve
+  // mapping shared memory. On Mac, the shared memory is created in the browser
+  // process and the cached metadata is returned. On Windows, this involves
+  // duplicating the handle from the remote process.  The RenderProcessHost
+  // still owns the returned DIB.
+  virtual TransportDIB* GetTransportDIB(TransportDIB::Id dib_id) = 0;
 
   // Static management functions -----------------------------------------------
 
diff --git a/chrome/browser/renderer_host/render_widget_host.cc b/chrome/browser/renderer_host/render_widget_host.cc
index bf98b7d..a6efd58 100644
--- a/chrome/browser/renderer_host/render_widget_host.cc
+++ b/chrome/browser/renderer_host/render_widget_host.cc
@@ -763,7 +763,6 @@ void RenderWidgetHost::OnMsgPaintAtSizeAck(int tag, const gfx::Size& size) {
 
 void RenderWidgetHost::OnMsgUpdateRect(
     const ViewHostMsg_UpdateRect_Params& params) {
-  TransportDIB::ScopedHandle dib_handle(params.dib_handle);
   TimeTicks paint_start = TimeTicks::Now();
 
   if (paint_observer_.get())
@@ -798,8 +797,7 @@ void RenderWidgetHost::OnMsgUpdateRect(
   if (!is_gpu_rendering_active_) {
     const size_t size = params.bitmap_rect.height() *
         params.bitmap_rect.width() * 4;
-    TransportDIB* dib = process_->GetTransportDIB(params.dib_id,
-                                                  dib_handle.release());
+    TransportDIB* dib = process_->GetTransportDIB(params.bitmap);
 
     // If gpu process does painting, scroll_rect and copy_rects are always empty
     // and backing store is never used.
@@ -818,11 +816,8 @@ void RenderWidgetHost::OnMsgUpdateRect(
         // Paint the backing store. This will update it with the
         // renderer-supplied bits. The view will read out of the backing store
         // later to actually draw to the screen.
-        PaintBackingStoreRect(params.dib_id,
-                              params.dib_handle,
-                              params.bitmap_rect,
-                              params.copy_rects,
-                              params.view_size,
+        PaintBackingStoreRect(params.bitmap, params.bitmap_rect,
+                              params.copy_rects, params.view_size,
                               &painted_synchronously);
       }
     }
@@ -886,10 +881,9 @@ void RenderWidgetHost::OnMsgCreateVideo(const gfx::Size& size) {
   Send(new ViewMsg_CreateVideo_ACK(routing_id_, -1));
 }
 
-void RenderWidgetHost::OnMsgUpdateVideo(TransportDIB::Id dib_id,
-                                        TransportDIB::Handle dib_handle,
+void RenderWidgetHost::OnMsgUpdateVideo(TransportDIB::Id bitmap,
                                         const gfx::Rect& bitmap_rect) {
-  PaintVideoLayer(dib_id, dib_handle, bitmap_rect);
+  PaintVideoLayer(bitmap, bitmap_rect);
 
   // TODO(scherkus): support actual video ids!
   Send(new ViewMsg_UpdateVideo_ACK(routing_id_, -1));
@@ -1055,10 +1049,9 @@ void RenderWidgetHost::OnAcceleratedSurfaceSetTransportDIB(
     int32 width,
     int32 height,
     TransportDIB::Handle transport_dib) {
-  TransportDIB::ScopedHandle scoped_dib_handle(transport_dib);
   if (view_) {
     view_->AcceleratedSurfaceSetTransportDIB(window, width, height,
-                                             scoped_dib_handle.release());
+                                             transport_dib);
   }
 }
 
@@ -1092,8 +1085,7 @@ void RenderWidgetHost::OnMsgDestroyPluginContainer(gfx::PluginWindowHandle id) {
 #endif
 
 void RenderWidgetHost::PaintBackingStoreRect(
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     const gfx::Size& view_size,
@@ -1115,13 +1107,8 @@ void RenderWidgetHost::PaintBackingStoreRect(
   }
 
   bool needs_full_paint = false;
-  BackingStoreManager::PrepareBackingStore(this,
-                                           view_size,
-                                           dib_id,
-                                           dib_handle,
-                                           bitmap_rect,
-                                           copy_rects,
-                                           &needs_full_paint,
+  BackingStoreManager::PrepareBackingStore(this, view_size, bitmap, bitmap_rect,
+                                           copy_rects, &needs_full_paint,
                                            painted_synchronously);
   if (needs_full_paint) {
     repaint_start_time_ = TimeTicks::Now();
@@ -1150,13 +1137,12 @@ void RenderWidgetHost::ScrollBackingStoreRect(int dx, int dy,
   backing_store->ScrollBackingStore(dx, dy, clip_rect, view_size);
 }
 
-void RenderWidgetHost::PaintVideoLayer(TransportDIB::Id dib_id,
-                                       TransportDIB::Handle dib_handle,
+void RenderWidgetHost::PaintVideoLayer(TransportDIB::Id bitmap,
                                        const gfx::Rect& bitmap_rect) {
   if (is_hidden_ || !video_layer_.get())
     return;
 
-  video_layer_->CopyTransportDIB(process(), dib_id, dib_handle, bitmap_rect);
+  video_layer_->CopyTransportDIB(process(), bitmap, bitmap_rect);
 
   // Don't update the view if we're hidden or if the view has been destroyed.
   if (is_hidden_ || !view_)
diff --git a/chrome/browser/renderer_host/render_widget_host.h b/chrome/browser/renderer_host/render_widget_host.h
index 26d1c2c..6c3fed7 100644
--- a/chrome/browser/renderer_host/render_widget_host.h
+++ b/chrome/browser/renderer_host/render_widget_host.h
@@ -480,9 +480,7 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   void OnMsgPaintAtSizeAck(int tag, const gfx::Size& size);
   void OnMsgUpdateRect(const ViewHostMsg_UpdateRect_Params& params);
   void OnMsgCreateVideo(const gfx::Size& size);
-  void OnMsgUpdateVideo(TransportDIB::Id dib_id,
-                        TransportDIB::Handle dib_handle,
-                        const gfx::Rect& bitmap_rect);
+  void OnMsgUpdateVideo(TransportDIB::Id bitmap, const gfx::Rect& bitmap_rect);
   void OnMsgDestroyVideo();
   void OnMsgInputEventAck(const IPC::Message& message);
   virtual void OnMsgFocus();
@@ -525,8 +523,7 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   // synchronously, and the bitmap is done being used. False means that the
   // backing store will paint the bitmap at a later time and that the DIB can't
   // be freed (it will be the backing store's job to free it later).
-  void PaintBackingStoreRect(TransportDIB::Id dib_id,
-                             TransportDIB::Handle dib_handle,
+  void PaintBackingStoreRect(TransportDIB::Id bitmap,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects,
                              const gfx::Size& view_size,
@@ -541,8 +538,7 @@ class RenderWidgetHost : public IPC::Channel::Listener,
   // Paints the entire given bitmap into the current video layer, if it exists.
   // |bitmap_rect| specifies the destination size and absolute location of the
   // bitmap on the backing store.
-  void PaintVideoLayer(TransportDIB::Id dib_id,
-                       TransportDIB::Handle dib_handle,
+  void PaintVideoLayer(TransportDIB::Id bitmap,
                        const gfx::Rect& bitmap_rect);
 
   // Called by OnMsgInputEventAck() to process a keyboard event ack message.
diff --git a/chrome/browser/renderer_host/render_widget_host_unittest.cc b/chrome/browser/renderer_host/render_widget_host_unittest.cc
index 02b3bd8..1c5bb17 100644
--- a/chrome/browser/renderer_host/render_widget_host_unittest.cc
+++ b/chrome/browser/renderer_host/render_widget_host_unittest.cc
@@ -84,8 +84,7 @@ void RenderWidgetHostProcess::InitUpdateRectParams(
 
   if (!current_update_buf_)
     current_update_buf_ = TransportDIB::Create(pixel_size, 0);
-  params->dib_id = current_update_buf_->id();
-  params->dib_handle = current_update_buf_->handle();
+  params->bitmap = current_update_buf_->id();
   params->bitmap_rect = gfx::Rect(0, 0, w, h);
   params->dx = 0;
   params->dy = 0;
diff --git a/chrome/browser/renderer_host/test/test_backing_store.cc b/chrome/browser/renderer_host/test/test_backing_store.cc
index 01dc7d8..d90c7fd 100644
--- a/chrome/browser/renderer_host/test/test_backing_store.cc
+++ b/chrome/browser/renderer_host/test/test_backing_store.cc
@@ -14,8 +14,7 @@ TestBackingStore::~TestBackingStore() {
 
 void TestBackingStore::PaintToBackingStore(
     RenderProcessHost* process,
-    TransportDIB::Id dib_id,
-    TransportDIB::Handle dib_handle,
+    TransportDIB::Id bitmap,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects,
     bool* painted_synchronously) {
diff --git a/chrome/browser/renderer_host/test/test_backing_store.h b/chrome/browser/renderer_host/test/test_backing_store.h
index d532dc1..f9db76e 100644
--- a/chrome/browser/renderer_host/test/test_backing_store.h
+++ b/chrome/browser/renderer_host/test/test_backing_store.h
@@ -16,8 +16,7 @@ class TestBackingStore : public BackingStore {
 
   // BackingStore implementation.
   virtual void PaintToBackingStore(RenderProcessHost* process,
-                                   TransportDIB::Id dib_id,
-                                   TransportDIB::Handle dib_handle,
+                                   TransportDIB::Id bitmap,
                                    const gfx::Rect& bitmap_rect,
                                    const std::vector<gfx::Rect>& copy_rects,
                                    bool* painted_synchronously);
diff --git a/chrome/browser/renderer_host/video_layer.h b/chrome/browser/renderer_host/video_layer.h
index 4bcc245..0d7d4f8 100644
--- a/chrome/browser/renderer_host/video_layer.h
+++ b/chrome/browser/renderer_host/video_layer.h
@@ -26,13 +26,12 @@ class VideoLayer {
   RenderWidgetHost* render_widget_host() const { return render_widget_host_; }
   const gfx::Size& size() { return size_; }
 
-  // Copy the incoming bitmap into this video layer. The given DIB contains YUV
+  // Copy the incoming bitmap into this video layer. |bitmap| contains YUV
   // pixel data in YV12 format and must be the same dimensions as this video
   // layer. |bitmap_rect| specifies the absolute position and destination size
   // of the bitmap on the backing store.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id dib_id,
-                                TransportDIB::Handle dib_handle,
+                                TransportDIB::Id bitmap,
                                 const gfx::Rect& bitmap_rect) = 0;
 
  protected:
diff --git a/chrome/browser/renderer_host/video_layer_proxy.cc b/chrome/browser/renderer_host/video_layer_proxy.cc
index fb4cfe9..3df1d25 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.cc
+++ b/chrome/browser/renderer_host/video_layer_proxy.cc
@@ -5,6 +5,7 @@
 #include "chrome/browser/renderer_host/video_layer_proxy.h"
 
 #include "chrome/browser/gpu_process_host_ui_shim.h"
+#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/common/gpu_messages.h"
 #include "gfx/rect.h"
 
@@ -23,12 +24,17 @@ VideoLayerProxy::~VideoLayerProxy() {
 }
 
 void VideoLayerProxy::CopyTransportDIB(RenderProcessHost* process,
-                                       TransportDIB::Id dib_id,
-                                       TransportDIB::Handle dib_handle,
+                                       TransportDIB::Id bitmap,
                                        const gfx::Rect& bitmap_rect) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
+  base::ProcessId process_id;
+#if defined(OS_WIN)
+  process_id = ::GetProcessId(process->GetHandle());
+#elif defined(OS_POSIX)
+  process_id = process->GetHandle();
+#endif
+
   if (process_shim_->Send(new GpuMsg_PaintToVideoLayer(
-          routing_id_, scoped_dib_handle.release(), bitmap_rect))) {
+          routing_id_, process_id, bitmap, bitmap_rect))) {
   } else {
     // TODO(scherkus): what to do ?!?!
   }
diff --git a/chrome/browser/renderer_host/video_layer_proxy.h b/chrome/browser/renderer_host/video_layer_proxy.h
index 4d3b1f2f..4a4cc71 100644
--- a/chrome/browser/renderer_host/video_layer_proxy.h
+++ b/chrome/browser/renderer_host/video_layer_proxy.h
@@ -20,8 +20,7 @@ class VideoLayerProxy : public VideoLayer, public IPC::Channel::Listener {
 
   // VideoLayer implementation.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id dib_id,
-                                TransportDIB::Handle dib_handle,
+                                TransportDIB::Id bitmap,
                                 const gfx::Rect& bitmap_rect);
 
   // IPC::Channel::Listener implementation.
diff --git a/chrome/browser/renderer_host/video_layer_x.cc b/chrome/browser/renderer_host/video_layer_x.cc
index a8a878b..09891b3 100644
--- a/chrome/browser/renderer_host/video_layer_x.cc
+++ b/chrome/browser/renderer_host/video_layer_x.cc
@@ -44,10 +44,8 @@ VideoLayerX::~VideoLayerX() {
 }
 
 void VideoLayerX::CopyTransportDIB(RenderProcessHost* process,
-                                   TransportDIB::Id dib_id,
-                                   TransportDIB::Handle dib_handle,
+                                   TransportDIB::Id bitmap,
                                    const gfx::Rect& bitmap_rect) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   if (!display_)
     return;
 
@@ -78,8 +76,7 @@ void VideoLayerX::CopyTransportDIB(RenderProcessHost* process,
     rgb_frame_size_ = new_rgb_frame_size;
   }
 
-  TransportDIB* dib = process->GetTransportDIB(dib_id,
-                                               scoped_dib_handle.release());
+  TransportDIB* dib = process->GetTransportDIB(bitmap);
   if (!dib)
     return;
 
diff --git a/chrome/browser/renderer_host/video_layer_x.h b/chrome/browser/renderer_host/video_layer_x.h
index 8c3a66f..a12c7b4 100644
--- a/chrome/browser/renderer_host/video_layer_x.h
+++ b/chrome/browser/renderer_host/video_layer_x.h
@@ -20,8 +20,7 @@ class VideoLayerX : public VideoLayer {
 
   // VideoLayer implementation.
   virtual void CopyTransportDIB(RenderProcessHost* process,
-                                TransportDIB::Id dib_id,
-                                TransportDIB::Handle dib_handle,
+                                TransportDIB::Id bitmap,
                                 const gfx::Rect& bitmap_rect);
 
   // Copy from the server-side video layer to the target window.
diff --git a/chrome/browser/tab_contents/thumbnail_generator.cc b/chrome/browser/tab_contents/thumbnail_generator.cc
index 34ddf42..520faf4 100644
--- a/chrome/browser/tab_contents/thumbnail_generator.cc
+++ b/chrome/browser/tab_contents/thumbnail_generator.cc
@@ -11,7 +11,6 @@
 #include "base/time.h"
 #include "build/build_config.h"
 #include "chrome/browser/renderer_host/backing_store.h"
-#include "chrome/browser/renderer_host/render_process_host.h"
 #include "chrome/browser/renderer_host/render_view_host.h"
 #include "chrome/browser/tab_contents/tab_contents.h"
 #include "chrome/common/notification_service.h"
@@ -209,8 +208,7 @@ void ThumbnailGenerator::AskForSnapshot(RenderWidgetHost* renderer,
   }
 
   renderer->PaintAtSize(
-      thumbnail_dib->GetHandleForProcess(renderer->process()->GetHandle()),
-      sequence_num, page_size, desired_size);
+      thumbnail_dib->handle(), sequence_num, page_size, desired_size);
 }
 
 SkBitmap ThumbnailGenerator::GetThumbnailForRenderer(
@@ -301,7 +299,7 @@ void ThumbnailGenerator::WidgetDidReceivePaintAtSizeAck(
   if (item != callback_map_.end()) {
     TransportDIB* dib = item->second->thumbnail_dib.get();
     DCHECK(dib);
-    if (!dib || !dib->Map()) {
+    if (!dib) {
       return;
     }
 
diff --git a/chrome/common/common_param_traits.h b/chrome/common/common_param_traits.h
index 2fed4b3..11c9749 100644
--- a/chrome/common/common_param_traits.h
+++ b/chrome/common/common_param_traits.h
@@ -12,10 +12,6 @@
 #define CHROME_COMMON_COMMON_PARAM_TRAITS_H_
 #pragma once
 
-#if defined(OS_WIN)
-#include <windows.h>
-#endif
-
 #include "app/surface/transport_dib.h"
 #include "base/file_util.h"
 #include "base/ref_counted.h"
@@ -240,33 +236,22 @@ struct ParamTraits<webkit_glue::WebApplicationInfo> {
 
 
 #if defined(OS_WIN)
-template <>
-struct ParamTraits<TransportDIB::Handle> {
-  typedef TransportDIB::Handle param_type;
+template<>
+struct ParamTraits<TransportDIB::Id> {
+  typedef TransportDIB::Id param_type;
   static void Write(Message* m, const param_type& p) {
-    WriteParam(m, p.section());
-    WriteParam(m, p.owner_id());
-    WriteParam(m, p.should_dup_on_map());
+    WriteParam(m, p.handle);
+    WriteParam(m, p.sequence_num);
   }
   static bool Read(const Message* m, void** iter, param_type* r) {
-    HANDLE section;
-    base::ProcessId owner_id;
-    bool should_dup_on_map;
-    bool success = ReadParam(m, iter, &section) &&
-                   ReadParam(m, iter, &owner_id) &&
-                   ReadParam(m, iter, &should_dup_on_map);
-    if (success) {
-      *r = TransportDIB::Handle(section, owner_id, should_dup_on_map);
-    }
-    return success;
+    return (ReadParam(m, iter, &r->handle) &&
+            ReadParam(m, iter, &r->sequence_num));
   }
   static void Log(const param_type& p, std::string* l) {
-    l->append("TransportDIB::Handle(");
-    LogParam(p.section(), l);
-    l->append(", ");
-    LogParam(p.owner_id(), l);
+    l->append("TransportDIB(");
+    LogParam(p.handle, l);
     l->append(", ");
-    LogParam(p.should_dup_on_map(), l);
+    LogParam(p.sequence_num, l);
     l->append(")");
   }
 };
diff --git a/chrome/common/gpu_messages_internal.h b/chrome/common/gpu_messages_internal.h
index deb48f8..184d8f4 100644
--- a/chrome/common/gpu_messages_internal.h
+++ b/chrome/common/gpu_messages_internal.h
@@ -74,11 +74,13 @@ IPC_BEGIN_MESSAGES(Gpu)
   // Updates the backing store with the given bitmap. The GPU process will send
   // back a GpuHostMsg_PaintToBackingStore_ACK after the paint is complete to
   // let the caller know the TransportDIB can be freed or reused.
-  IPC_MESSAGE_ROUTED3(GpuMsg_PaintToBackingStore,
-                      TransportDIB::Handle, /* bitmap_handle */
+  IPC_MESSAGE_ROUTED4(GpuMsg_PaintToBackingStore,
+                      base::ProcessId, /* process */
+                      TransportDIB::Id, /* bitmap */
                       gfx::Rect, /* bitmap_rect */
                       std::vector<gfx::Rect>) /* copy_rects */
 
+
   IPC_MESSAGE_ROUTED4(GpuMsg_ScrollBackingStore,
                       int, /* dx */
                       int, /* dy */
@@ -93,8 +95,9 @@ IPC_BEGIN_MESSAGES(Gpu)
   // Updates the video layer with the given YUV data. The GPU process will send
   // back a GpuHostMsg_PaintToVideoLayer_ACK after the paint is complete to
   // let the caller know the TransportDIB can be freed or reused.
-  IPC_MESSAGE_ROUTED2(GpuMsg_PaintToVideoLayer,
-                      TransportDIB::Handle, /* bitmap_handle */
+  IPC_MESSAGE_ROUTED3(GpuMsg_PaintToVideoLayer,
+                      base::ProcessId, /* process */
+                      TransportDIB::Id, /* bitmap */
                       gfx::Rect) /* bitmap_rect */
 
 IPC_END_MESSAGES(Gpu)
diff --git a/chrome/common/render_messages_internal.h b/chrome/common/render_messages_internal.h
index 70edb54..75eacdf 100644
--- a/chrome/common/render_messages_internal.h
+++ b/chrome/common/render_messages_internal.h
@@ -1276,9 +1276,8 @@ IPC_BEGIN_MESSAGES(ViewHost)
   // Sent to create, update and destroy video layers.
   IPC_MESSAGE_ROUTED1(ViewHostMsg_CreateVideo,
                       gfx::Size /* size */)
-  IPC_MESSAGE_ROUTED3(ViewHostMsg_UpdateVideo,
-                      TransportDIB::Id /* bitmap_id */,
-                      TransportDIB::Handle /* bitmap_handle */,
+  IPC_MESSAGE_ROUTED2(ViewHostMsg_UpdateVideo,
+                      TransportDIB::Id /* bitmap */,
                       gfx::Rect /* bitmap_rect */)
   IPC_MESSAGE_ROUTED0(ViewHostMsg_DestroyVideo)
 
diff --git a/chrome/common/render_messages_params.cc b/chrome/common/render_messages_params.cc
index 73f5ea2..59802b4 100644
--- a/chrome/common/render_messages_params.cc
+++ b/chrome/common/render_messages_params.cc
@@ -38,11 +38,11 @@ ViewHostMsg_FrameNavigate_Params::~ViewHostMsg_FrameNavigate_Params() {
 }
 
 ViewHostMsg_UpdateRect_Params::ViewHostMsg_UpdateRect_Params()
-    : dib_id(0),
-      dib_handle(TransportDIB::DefaultHandleValue()),
-      dx(0),
+    : dx(0),
       dy(0),
       flags(0) {
+    // On windows, bitmap is of type "struct HandleAndSequenceNum"
+    memset(&bitmap, 0, sizeof(bitmap));
 }
 
 ViewHostMsg_UpdateRect_Params::~ViewHostMsg_UpdateRect_Params() {
@@ -835,8 +835,7 @@ void ParamTraits<ViewHostMsg_FrameNavigate_Params>::Log(const param_type& p,
 
 void ParamTraits<ViewHostMsg_UpdateRect_Params>::Write(
     Message* m, const param_type& p) {
-  WriteParam(m, p.dib_id);
-  WriteParam(m, p.dib_handle);
+  WriteParam(m, p.bitmap);
   WriteParam(m, p.bitmap_rect);
   WriteParam(m, p.dx);
   WriteParam(m, p.dy);
@@ -850,8 +849,7 @@ void ParamTraits<ViewHostMsg_UpdateRect_Params>::Write(
 bool ParamTraits<ViewHostMsg_UpdateRect_Params>::Read(
     const Message* m, void** iter, param_type* p) {
   return
-      ReadParam(m, iter, &p->dib_id) &&
-      ReadParam(m, iter, &p->dib_handle) &&
+      ReadParam(m, iter, &p->bitmap) &&
       ReadParam(m, iter, &p->bitmap_rect) &&
       ReadParam(m, iter, &p->dx) &&
       ReadParam(m, iter, &p->dy) &&
@@ -865,9 +863,7 @@ bool ParamTraits<ViewHostMsg_UpdateRect_Params>::Read(
 void ParamTraits<ViewHostMsg_UpdateRect_Params>::Log(const param_type& p,
                                                      std::string* l) {
   l->append("(");
-  LogParam(p.dib_id, l);
-  l->append(", ");
-  LogParam(p.dib_handle, l);
+  LogParam(p.bitmap, l);
   l->append(", ");
   LogParam(p.bitmap_rect, l);
   l->append(", ");
diff --git a/chrome/common/render_messages_params.h b/chrome/common/render_messages_params.h
index 211de1a..2eeff70 100644
--- a/chrome/common/render_messages_params.h
+++ b/chrome/common/render_messages_params.h
@@ -321,12 +321,9 @@ struct ViewHostMsg_UpdateRect_Params {
   ViewHostMsg_UpdateRect_Params();
   ~ViewHostMsg_UpdateRect_Params();
 
-  // The ID of the bitmap to be painted into the view at the locations specified
-  // by update_rects.
-  TransportDIB::Id dib_id;
-
-  // The handle to the bitmap, in case it needs to be mapped on the browser.
-  TransportDIB::Handle dib_handle;
+  // The bitmap to be painted into the view at the locations specified by
+  // update_rects.
+  TransportDIB::Id bitmap;
 
   // The position and size of the bitmap.
   gfx::Rect bitmap_rect;
diff --git a/chrome/gpu/gpu_backing_store_glx.cc b/chrome/gpu/gpu_backing_store_glx.cc
index ba5fa20..916a1db 100644
--- a/chrome/gpu/gpu_backing_store_glx.cc
+++ b/chrome/gpu/gpu_backing_store_glx.cc
@@ -60,10 +60,11 @@ void GpuBackingStoreGLX::OnChannelError() {
 }
 
 void GpuBackingStoreGLX::OnPaintToBackingStore(
-    TransportDIB::Handle dib_handle,
+    base::ProcessId source_process_id,
+    TransportDIB::Id id,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects) {
-  scoped_ptr<TransportDIB> dib(TransportDIB::Map(dib_handle));
+  scoped_ptr<TransportDIB> dib(TransportDIB::Map(id));
   view_->BindContext();
 
   scoped_ptr<skia::PlatformCanvas> canvas(
diff --git a/chrome/gpu/gpu_backing_store_glx.h b/chrome/gpu/gpu_backing_store_glx.h
index af1ced5..14b1f5f 100644
--- a/chrome/gpu/gpu_backing_store_glx.h
+++ b/chrome/gpu/gpu_backing_store_glx.h
@@ -36,7 +36,8 @@ class GpuBackingStoreGLX : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToBackingStore(TransportDIB::Handle dib_handle,
+  void OnPaintToBackingStore(base::ProcessId source_process_id,
+                             TransportDIB::Id id,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects);
   void OnScrollBackingStore(int dx, int dy,
diff --git a/chrome/gpu/gpu_backing_store_win.cc b/chrome/gpu/gpu_backing_store_win.cc
index 2b22369..d5af441 100644
--- a/chrome/gpu/gpu_backing_store_win.cc
+++ b/chrome/gpu/gpu_backing_store_win.cc
@@ -116,10 +116,21 @@ void GpuBackingStoreWin::OnChannelError() {
 }
 
 void GpuBackingStoreWin::OnPaintToBackingStore(
-    TransportDIB::Handle dib_handle,
+    base::ProcessId source_process_id,
+    TransportDIB::Id id,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects) {
-  scoped_ptr<TransportDIB> dib(TransportDIB::Map(dib_handle));
+  HANDLE source_process_handle = OpenProcess(PROCESS_ALL_ACCESS,
+                                             FALSE, source_process_id);
+  CHECK(source_process_handle);
+
+  // On Windows we need to duplicate the handle from the remote process.
+  // See BrowserRenderProcessHost::MapTransportDIB for how to do this on other
+  // platforms.
+  HANDLE section = win_util::GetSectionFromProcess(
+      id.handle, source_process_handle, false /* read write */);
+  CHECK(section);
+  scoped_ptr<TransportDIB> dib(TransportDIB::Map(section));
   CHECK(dib.get());
 
   if (!backing_store_dib_) {
@@ -157,6 +168,7 @@ void GpuBackingStoreWin::OnPaintToBackingStore(
     view_->InvalidateRect(&paint_rect.ToRECT());
   }
 
+  CloseHandle(source_process_handle);
   gpu_thread_->Send(new GpuHostMsg_PaintToBackingStore_ACK(routing_id_));
 }
 
diff --git a/chrome/gpu/gpu_backing_store_win.h b/chrome/gpu/gpu_backing_store_win.h
index 2899e93..fc4bfd9 100644
--- a/chrome/gpu/gpu_backing_store_win.h
+++ b/chrome/gpu/gpu_backing_store_win.h
@@ -42,7 +42,8 @@ class GpuBackingStoreWin : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToBackingStore(TransportDIB::Handle dib_handle,
+  void OnPaintToBackingStore(base::ProcessId source_process_id,
+                             TransportDIB::Id id,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects);
   void OnScrollBackingStore(int dx, int dy,
diff --git a/chrome/gpu/gpu_video_layer_glx.cc b/chrome/gpu/gpu_video_layer_glx.cc
index dffa35e..d0578ad 100644
--- a/chrome/gpu/gpu_video_layer_glx.cc
+++ b/chrome/gpu/gpu_video_layer_glx.cc
@@ -251,9 +251,9 @@ void GpuVideoLayerGLX::OnChannelError() {
   NOTIMPLEMENTED();
 }
 
-void GpuVideoLayerGLX::OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
+void GpuVideoLayerGLX::OnPaintToVideoLayer(base::ProcessId source_process_id,
+                                           TransportDIB::Id id,
                                            const gfx::Rect& bitmap_rect) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
   // TODO(scherkus): |native_size_| is set in constructor, so perhaps this check
   // should be a DCHECK().
   const int width = native_size_.width();
@@ -264,7 +264,7 @@ void GpuVideoLayerGLX::OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
       height <= 0 || height > kMaxVideoLayerSize)
     return;
 
-  TransportDIB* dib = TransportDIB::Map(scoped_dib_handle.release());
+  TransportDIB* dib = TransportDIB::Map(id);
   if (!dib)
     return;
 
diff --git a/chrome/gpu/gpu_video_layer_glx.h b/chrome/gpu/gpu_video_layer_glx.h
index 89d00b1..4b3497f 100644
--- a/chrome/gpu/gpu_video_layer_glx.h
+++ b/chrome/gpu/gpu_video_layer_glx.h
@@ -40,7 +40,8 @@ class GpuVideoLayerGLX : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
+  void OnPaintToVideoLayer(base::ProcessId source_process_id,
+                           TransportDIB::Id id,
                            const gfx::Rect& bitmap_rect);
 
   // Calculates vertices for |object| relative to |world|, where |world| is
diff --git a/chrome/plugin/webplugin_proxy.cc b/chrome/plugin/webplugin_proxy.cc
index 207b58d..f41da3e 100644
--- a/chrome/plugin/webplugin_proxy.cc
+++ b/chrome/plugin/webplugin_proxy.cc
@@ -485,8 +485,6 @@ void WebPluginProxy::UpdateGeometry(
     int ack_key
 #endif
     ) {
-  TransportDIB::ScopedHandle scoped_windowless_handle(windowless_buffer);
-  TransportDIB::ScopedHandle scoped_background_handle(background_buffer);
   gfx::Rect old = delegate_->GetRect();
   gfx::Rect old_clip_rect = delegate_->GetClipRect();
   transparent_ = transparent;
@@ -496,9 +494,7 @@ void WebPluginProxy::UpdateGeometry(
   // synchronous calls that lead to nested UpdateGeometry calls.
   if (TransportDIB::is_valid(windowless_buffer)) {
     // The plugin's rect changed, so now we have a new buffer to draw into.
-    SetWindowlessBuffer(scoped_windowless_handle.release(),
-                        scoped_background_handle.release(),
-                        window_rect);
+    SetWindowlessBuffer(windowless_buffer, background_buffer, window_rect);
   }
 
 #if defined(OS_MACOSX)
@@ -523,31 +519,61 @@ void WebPluginProxy::UpdateGeometry(
 #endif
 }
 
+#if defined(OS_WIN)
 void WebPluginProxy::SetWindowlessBuffer(
     const TransportDIB::Handle& windowless_buffer,
     const TransportDIB::Handle& background_buffer,
     const gfx::Rect& window_rect) {
-  // We have to handle errors here since we're mapping a large amount of memory
-  // that may not fit in our address space. Also, the renderer may have already
-  // destroyed the TransportDIB by the time we receive the handle, e.g. in case
-  // of multiple resizes.
-#if defined(OS_MACOSX)
+  // Create a canvas that will reference the shared bits. We have to handle
+  // errors here since we're mapping a large amount of memory that may not fit
+  // in our address space, or go wrong in some other way.
+  windowless_canvas_.reset(new skia::PlatformCanvas);
+  if (!windowless_canvas_->initialize(
+          window_rect.width(),
+          window_rect.height(),
+          true,
+          win_util::GetSectionFromProcess(windowless_buffer,
+              channel_->renderer_handle(), false))) {
+    windowless_canvas_.reset();
+    background_canvas_.reset();
+    return;
+  }
+
+  if (background_buffer) {
+    background_canvas_.reset(new skia::PlatformCanvas);
+    if (!background_canvas_->initialize(
+            window_rect.width(),
+            window_rect.height(),
+            true,
+            win_util::GetSectionFromProcess(background_buffer,
+                channel_->renderer_handle(), false))) {
+      windowless_canvas_.reset();
+      background_canvas_.reset();
+      return;
+    }
+  }
+}
+
+#elif defined(OS_MACOSX)
+
+void WebPluginProxy::SetWindowlessBuffer(
+    const TransportDIB::Handle& windowless_buffer,
+    const TransportDIB::Handle& background_buffer,
+    const gfx::Rect& window_rect) {
+  // Convert the shared memory handle to a handle that works in our process,
+  // and then use that to create a CGContextRef.
   windowless_dib_.reset(TransportDIB::Map(windowless_buffer));
   background_dib_.reset(TransportDIB::Map(background_buffer));
-  if (windowless_dib_.get()) {
-    windowless_context_.reset(CGBitmapContextCreate(
-        windowless_dib_->memory(),
-        window_rect.width(),
-        window_rect.height(),
-        8, 4 * window_rect.width(),
-        mac_util::GetSystemColorSpace(),
-        kCGImageAlphaPremultipliedFirst |
-        kCGBitmapByteOrder32Host));
-    CGContextTranslateCTM(windowless_context_, 0, window_rect.height());
-    CGContextScaleCTM(windowless_context_, 1, -1);
-  } else {
-    windowless_context_.reset();
-  }
+  windowless_context_.reset(CGBitmapContextCreate(
+      windowless_dib_->memory(),
+      window_rect.width(),
+      window_rect.height(),
+      8, 4 * window_rect.width(),
+      mac_util::GetSystemColorSpace(),
+      kCGImageAlphaPremultipliedFirst |
+      kCGBitmapByteOrder32Host));
+  CGContextTranslateCTM(windowless_context_, 0, window_rect.height());
+  CGContextScaleCTM(windowless_context_, 1, -1);
   if (background_dib_.get()) {
     background_context_.reset(CGBitmapContextCreate(
         background_dib_->memory(),
@@ -559,28 +585,32 @@ void WebPluginProxy::SetWindowlessBuffer(
         kCGBitmapByteOrder32Host));
     CGContextTranslateCTM(background_context_, 0, window_rect.height());
     CGContextScaleCTM(background_context_, 1, -1);
-  } else {
-    background_context_.reset();
   }
-#else
+}
+
+#elif defined(USE_X11)
+
+void WebPluginProxy::SetWindowlessBuffer(
+    const TransportDIB::Handle& windowless_buffer,
+    const TransportDIB::Handle& background_buffer,
+    const gfx::Rect& window_rect) {
   int width = window_rect.width();
   int height = window_rect.height();
-  windowless_dib_.reset(TransportDIB::CreateWithHandle(windowless_buffer));
-  background_dib_.reset(TransportDIB::CreateWithHandle(background_buffer));
-  windowless_canvas_.reset(windowless_dib_->GetPlatformCanvas(width, height));
-  background_canvas_.reset(background_dib_->GetPlatformCanvas(width, height));
-  if (!windowless_canvas_.get() || !background_canvas_.get()) {
+  windowless_dib_.reset(TransportDIB::Map(windowless_buffer));
+  if (windowless_dib_.get()) {
+    windowless_canvas_.reset(windowless_dib_->GetPlatformCanvas(width, height));
+  } else {
+    // This can happen if the renderer has already destroyed the TransportDIB
+    // by the time we receive the handle, e.g. in case of multiple resizes.
     windowless_canvas_.reset();
+  }
+  background_dib_.reset(TransportDIB::Map(background_buffer));
+  if (background_dib_.get()) {
+    background_canvas_.reset(background_dib_->GetPlatformCanvas(width, height));
+  } else {
     background_canvas_.reset();
-    // Destroy the TransportDIB if the canvas was not created successfully.
-    // Otherwise we may have an unnecessary handle which is keeping the shared
-    // memory open.
-    windowless_dib_.reset();
-    background_dib_.reset();
   }
-#endif
 
-#if defined(USE_X11)
   // If SHM pixmaps support is available, create a SHM pixmap and
   // pass it to the delegate for windowless plugin painting.
   if (delegate_->IsWindowless() && use_shm_pixmap_ && windowless_dib_.get()) {
@@ -600,9 +630,10 @@ void WebPluginProxy::SetWindowlessBuffer(
 
     delegate_->SetWindowlessShmPixmap(windowless_shm_pixmap_);
   }
-#endif
 }
 
+#endif
+
 void WebPluginProxy::CancelDocumentLoad() {
   Send(new PluginHostMsg_CancelDocumentLoad(route_id_));
 }
diff --git a/chrome/plugin/webplugin_proxy.h b/chrome/plugin/webplugin_proxy.h
index 667bb63..a33dae7 100644
--- a/chrome/plugin/webplugin_proxy.h
+++ b/chrome/plugin/webplugin_proxy.h
@@ -205,9 +205,9 @@ class WebPluginProxy : public webkit_glue::WebPlugin {
   // Variables used for desynchronized windowless plugin painting.  See note in
   // webplugin_delegate_proxy.h for how this works.
   bool transparent_;
+#if defined(OS_MACOSX)
   scoped_ptr<TransportDIB> windowless_dib_;
   scoped_ptr<TransportDIB> background_dib_;
-#if defined(OS_MACOSX)
   base::mac::ScopedCFTypeRef<CGContextRef> windowless_context_;
   base::mac::ScopedCFTypeRef<CGContextRef> background_context_;
   scoped_ptr<WebPluginAcceleratedSurfaceProxy> accelerated_surface_;
@@ -216,6 +216,8 @@ class WebPluginProxy : public webkit_glue::WebPlugin {
   scoped_ptr<skia::PlatformCanvas> background_canvas_;
 
 #if defined(USE_X11)
+  scoped_ptr<TransportDIB> windowless_dib_;
+  scoped_ptr<TransportDIB> background_dib_;
   // If we can use SHM pixmaps for windowless plugin painting or not.
   bool use_shm_pixmap_;
   // The SHM pixmap for windowless plugin painting.
diff --git a/chrome/renderer/media/ipc_video_renderer.cc b/chrome/renderer/media/ipc_video_renderer.cc
index 15d05e6..d9a194d 100644
--- a/chrome/renderer/media/ipc_video_renderer.cc
+++ b/chrome/renderer/media/ipc_video_renderer.cc
@@ -160,7 +160,6 @@ void IPCVideoRenderer::DoUpdateVideo() {
 
   Send(new ViewHostMsg_UpdateVideo(routing_id_,
                                    transport_dib_->id(),
-                                   transport_dib_->handle(),
                                    video_rect_));
 }
 
diff --git a/chrome/renderer/nacl_desc_wrapper_chrome.cc b/chrome/renderer/nacl_desc_wrapper_chrome.cc
index 45a5a36..a4efc70 100644
--- a/chrome/renderer/nacl_desc_wrapper_chrome.cc
+++ b/chrome/renderer/nacl_desc_wrapper_chrome.cc
@@ -33,7 +33,7 @@ DescWrapper* DescWrapperFactory::ImportPepper2DSharedMemory(intptr_t shm_int) {
   return ImportShmHandle(dib->handle().fd, dib->size());
 #elif defined(OS_WIN)
   // TransportDIBs use MapViewOfFile shared memory on Windows.
-  return ImportShmHandle(dib->handle().section(), dib->size());
+  return ImportShmHandle(dib->handle(), dib->size());
 #else
 # error "What platform?"
 #endif
diff --git a/chrome/renderer/render_widget.cc b/chrome/renderer/render_widget.cc
index 2e7d975..8880a03 100644
--- a/chrome/renderer/render_widget.cc
+++ b/chrome/renderer/render_widget.cc
@@ -508,7 +508,6 @@ void RenderWidget::DoDeferredUpdate() {
   // A plugin may be able to do an optimized paint. First check this, in which
   // case we can skip all of the bitmap generation and regular paint code.
   TransportDIB::Id dib_id = TransportDIB::Id();
-  TransportDIB::Handle dib_handle = TransportDIB::DefaultHandleValue();
   TransportDIB* dib = NULL;
   std::vector<gfx::Rect> copy_rects;
   gfx::Rect optimized_copy_rect, optimized_copy_location;
@@ -519,7 +518,6 @@ void RenderWidget::DoDeferredUpdate() {
     bounds = optimized_copy_location;
     copy_rects.push_back(optimized_copy_rect);
     dib_id = dib->id();
-    dib_handle = dib->handle();
   } else if (!is_gpu_rendering_active_) {
     // Compute a buffer for painting and cache it.
     scoped_ptr<skia::PlatformCanvas> canvas(
@@ -555,7 +553,6 @@ void RenderWidget::DoDeferredUpdate() {
       PaintRect(copy_rects[i], bounds.origin(), canvas.get());
 
     dib_id = current_paint_buf_->id();
-    dib_handle = current_paint_buf_->handle();
   } else {  // Accelerated compositing path
     // Begin painting.
     bool finish = next_paint_is_resize_ack();
@@ -564,8 +561,7 @@ void RenderWidget::DoDeferredUpdate() {
 
   // sending an ack to browser process that the paint is complete...
   ViewHostMsg_UpdateRect_Params params;
-  params.dib_id = dib_id;
-  params.dib_handle = dib_handle;
+  params.bitmap = dib_id;
   params.bitmap_rect = bounds;
   params.dx = update.scroll_delta.x();
   params.dy = update.scroll_delta.y();
@@ -823,8 +819,7 @@ void RenderWidget::OnMsgPaintAtSize(const TransportDIB::Handle& dib_handle,
                                     int tag,
                                     const gfx::Size& page_size,
                                     const gfx::Size& desired_size) {
-  TransportDIB::ScopedHandle scoped_dib_handle(dib_handle);
-  if (!webwidget_ || !TransportDIB::is_valid(dib_handle))
+  if (!webwidget_ || dib_handle == TransportDIB::DefaultHandleValue())
     return;
 
   if (page_size.IsEmpty() || desired_size.IsEmpty()) {
@@ -836,17 +831,13 @@ void RenderWidget::OnMsgPaintAtSize(const TransportDIB::Handle& dib_handle,
 
   // Map the given DIB ID into this process, and unmap it at the end
   // of this function.
-  scoped_ptr<TransportDIB> paint_at_size_buffer(
-      TransportDIB::CreateWithHandle(scoped_dib_handle.release()));
-  gfx::Size canvas_size = page_size;
-  scoped_ptr<skia::PlatformCanvas> canvas(
-      paint_at_size_buffer->GetPlatformCanvas(canvas_size.width(),
-                                              canvas_size.height()));
-  if (!canvas.get()) {
-    NOTREACHED();
+  scoped_ptr<TransportDIB> paint_at_size_buffer(TransportDIB::Map(dib_handle));
+
+  DCHECK(paint_at_size_buffer.get());
+  if (!paint_at_size_buffer.get())
     return;
-  }
 
+  gfx::Size canvas_size = page_size;
   float x_scale = static_cast<float>(desired_size.width()) /
                   static_cast<float>(canvas_size.width());
   float y_scale = static_cast<float>(desired_size.height()) /
@@ -857,6 +848,14 @@ void RenderWidget::OnMsgPaintAtSize(const TransportDIB::Handle& dib_handle,
   canvas_size.set_height(static_cast<int>(canvas_size.height() * y_scale));
   gfx::Rect bounds(canvas_size);
 
+  scoped_ptr<skia::PlatformCanvas> canvas(
+      paint_at_size_buffer->GetPlatformCanvas(canvas_size.width(),
+                                              canvas_size.height()));
+  if (!canvas.get()) {
+    NOTREACHED();
+    return;
+  }
+
   // Reset bounds to what we actually received, but they should be the
   // same.
   DCHECK_EQ(bounds.width(), canvas->getDevice()->width());
diff --git a/chrome/renderer/webplugin_delegate_proxy.cc b/chrome/renderer/webplugin_delegate_proxy.cc
index 7b3938e..a2553f2 100644
--- a/chrome/renderer/webplugin_delegate_proxy.cc
+++ b/chrome/renderer/webplugin_delegate_proxy.cc
@@ -1506,10 +1506,9 @@ void WebPluginDelegateProxy::OnAcceleratedSurfaceSetTransportDIB(
     int32 width,
     int32 height,
     TransportDIB::Handle transport_dib) {
-  TransportDIB::ScopedHandle scoped_dib_handle(transport_dib);
   if (render_view_)
     render_view_->AcceleratedSurfaceSetTransportDIB(window, width, height,
-        scoped_dib_handle.release());
+                                                    transport_dib);
 }
 
 void WebPluginDelegateProxy::OnAcceleratedSurfaceAllocTransportDIB(