gpu: Generate mailboxes on client side

Because mailboxes are now just a random number, we don't need to round-trip to
the gpu process to generate them, which lets us get rid of IPCs, layers, etc.

It also means generating a mailbox can't fail any more (even on a lost context),
so, removing some code paths and associated tests.

I'm adding a debug-only verification to ensure the mailboxes are generated from
the crypto-random function (in debug, we burn a byte to compute a mini XOR-check
as a sentinel for "we went through the Generate function"). It's not a secure
check, but should hit incorrect/unsafe usage.

BUG=None

Review URL: https://codereview.chromium.org/165393003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@251570 0039d316-1c4b-4281-b951-d872f2087c98

3 files changed, 34 insertions, 5 deletions

diff --git a/gpu/command_buffer/common/gpu_control.h b/gpu/command_buffer/common/gpu_control.h
index 448ab1d..e15d5e6 100644
--- a/gpu/command_buffer/common/gpu_control.h
+++ b/gpu/command_buffer/common/gpu_control.h
@@ -39,11 +39,6 @@ class GPU_EXPORT GpuControl {
   // Destroy a gpu memory buffer. The ID must be positive.
   virtual void DestroyGpuMemoryBuffer(int32 id) = 0;
 
-  // Generates n unique mailbox names that can be used with
-  // GL_texture_mailbox_CHROMIUM.
-  virtual bool GenerateMailboxNames(unsigned num,
-                                    std::vector<gpu::Mailbox>* names) = 0;
-
   // Inserts a sync point, returning its ID. Sync point IDs are global and can
   // be used for cross-context synchronization.
   virtual uint32 InsertSyncPoint() = 0;
diff --git a/gpu/command_buffer/common/mailbox.cc b/gpu/command_buffer/common/mailbox.cc
index 8d8393f..21602ab 100644
--- a/gpu/command_buffer/common/mailbox.cc
+++ b/gpu/command_buffer/common/mailbox.cc
@@ -7,6 +7,7 @@
 #include <string.h>
 
 #include "base/logging.h"
+#include "base/rand_util.h"
 
 namespace gpu {
 
@@ -31,4 +32,28 @@ void Mailbox::SetName(const int8* n) {
   memcpy(name, n, sizeof(name));
 }
 
+Mailbox Mailbox::Generate() {
+  Mailbox result;
+  // Generates cryptographically-secure bytes.
+  base::RandBytes(result.name, sizeof(result.name));
+#if !defined(NDEBUG)
+  int8 value = 1;
+  for (size_t i = 1; i < sizeof(result.name); ++i)
+    value ^= result.name[i];
+  result.name[0] = value;
+#endif
+  return result;
+}
+
+bool Mailbox::Verify() const {
+#if !defined(NDEBUG)
+  int8 value = 1;
+  for (size_t i = 0; i < sizeof(name); ++i)
+    value ^= name[i];
+  return value == 0;
+#else
+  return true;
+#endif
+}
+
 }  // namespace gpu
diff --git a/gpu/command_buffer/common/mailbox.h b/gpu/command_buffer/common/mailbox.h
index 08a970f..06b4b59 100644
--- a/gpu/command_buffer/common/mailbox.h
+++ b/gpu/command_buffer/common/mailbox.h
@@ -22,6 +22,15 @@ struct GPU_EXPORT Mailbox {
   bool IsZero() const;
   void SetZero();
   void SetName(const int8* name);
+
+  // Generate a unique unguessable mailbox name.
+  static Mailbox Generate();
+
+  // Verify that the mailbox was created through Mailbox::Generate. This only
+  // works in Debug (always returns true in Release). This is not a secure
+  // check, only to catch bugs where clients forgot to call Mailbox::Generate.
+  bool Verify() const;
+
   int8 name[GL_MAILBOX_SIZE_CHROMIUM];
   bool operator<(const Mailbox& other) const {
     return memcmp(this, &other, sizeof other) < 0;