6 files changed, 26 insertions, 9 deletions

diff --git a/chrome/gpu/gpu_backing_store_glx.cc b/chrome/gpu/gpu_backing_store_glx.cc
index ba5fa20..916a1db 100644
--- a/chrome/gpu/gpu_backing_store_glx.cc
+++ b/chrome/gpu/gpu_backing_store_glx.cc
@@ -60,10 +60,11 @@ void GpuBackingStoreGLX::OnChannelError() {
 }
 
 void GpuBackingStoreGLX::OnPaintToBackingStore(
-    TransportDIB::Handle dib_handle,
+    base::ProcessId source_process_id,
+    TransportDIB::Id id,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects) {
-  scoped_ptr<TransportDIB> dib(TransportDIB::Map(dib_handle));
+  scoped_ptr<TransportDIB> dib(TransportDIB::Map(id));
   view_->BindContext();
 
   scoped_ptr<skia::PlatformCanvas> canvas(
diff --git a/chrome/gpu/gpu_backing_store_glx.h b/chrome/gpu/gpu_backing_store_glx.h
index af1ced5..14b1f5f 100644
--- a/chrome/gpu/gpu_backing_store_glx.h
+++ b/chrome/gpu/gpu_backing_store_glx.h
@@ -36,7 +36,8 @@ class GpuBackingStoreGLX : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToBackingStore(TransportDIB::Handle dib_handle,
+  void OnPaintToBackingStore(base::ProcessId source_process_id,
+                             TransportDIB::Id id,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects);
   void OnScrollBackingStore(int dx, int dy,
diff --git a/chrome/gpu/gpu_backing_store_win.cc b/chrome/gpu/gpu_backing_store_win.cc
index 2b22369..d5af441 100644
--- a/chrome/gpu/gpu_backing_store_win.cc
+++ b/chrome/gpu/gpu_backing_store_win.cc
@@ -116,10 +116,21 @@ void GpuBackingStoreWin::OnChannelError() {
 }
 
 void GpuBackingStoreWin::OnPaintToBackingStore(
-    TransportDIB::Handle dib_handle,
+    base::ProcessId source_process_id,
+    TransportDIB::Id id,
     const gfx::Rect& bitmap_rect,
     const std::vector<gfx::Rect>& copy_rects) {
-  scoped_ptr<TransportDIB> dib(TransportDIB::Map(dib_handle));
+  HANDLE source_process_handle = OpenProcess(PROCESS_ALL_ACCESS,
+                                             FALSE, source_process_id);
+  CHECK(source_process_handle);
+
+  // On Windows we need to duplicate the handle from the remote process.
+  // See BrowserRenderProcessHost::MapTransportDIB for how to do this on other
+  // platforms.
+  HANDLE section = win_util::GetSectionFromProcess(
+      id.handle, source_process_handle, false /* read write */);
+  CHECK(section);
+  scoped_ptr<TransportDIB> dib(TransportDIB::Map(section));
   CHECK(dib.get());
 
   if (!backing_store_dib_) {
@@ -157,6 +168,7 @@ void GpuBackingStoreWin::OnPaintToBackingStore(
     view_->InvalidateRect(&paint_rect.ToRECT());
   }
 
+  CloseHandle(source_process_handle);
   gpu_thread_->Send(new GpuHostMsg_PaintToBackingStore_ACK(routing_id_));
 }
 
diff --git a/chrome/gpu/gpu_backing_store_win.h b/chrome/gpu/gpu_backing_store_win.h
index 2899e93..fc4bfd9 100644
--- a/chrome/gpu/gpu_backing_store_win.h
+++ b/chrome/gpu/gpu_backing_store_win.h
@@ -42,7 +42,8 @@ class GpuBackingStoreWin : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToBackingStore(TransportDIB::Handle dib_handle,
+  void OnPaintToBackingStore(base::ProcessId source_process_id,
+                             TransportDIB::Id id,
                              const gfx::Rect& bitmap_rect,
                              const std::vector<gfx::Rect>& copy_rects);
   void OnScrollBackingStore(int dx, int dy,
diff --git a/chrome/gpu/gpu_video_layer_glx.cc b/chrome/gpu/gpu_video_layer_glx.cc
index a90b387..d0578ad 100644
--- a/chrome/gpu/gpu_video_layer_glx.cc
+++ b/chrome/gpu/gpu_video_layer_glx.cc
@@ -251,7 +251,8 @@ void GpuVideoLayerGLX::OnChannelError() {
   NOTIMPLEMENTED();
 }
 
-void GpuVideoLayerGLX::OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
+void GpuVideoLayerGLX::OnPaintToVideoLayer(base::ProcessId source_process_id,
+                                           TransportDIB::Id id,
                                            const gfx::Rect& bitmap_rect) {
   // TODO(scherkus): |native_size_| is set in constructor, so perhaps this check
   // should be a DCHECK().
@@ -263,7 +264,7 @@ void GpuVideoLayerGLX::OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
       height <= 0 || height > kMaxVideoLayerSize)
     return;
 
-  TransportDIB* dib = TransportDIB::Map(dib_handle);
+  TransportDIB* dib = TransportDIB::Map(id);
   if (!dib)
     return;
 
diff --git a/chrome/gpu/gpu_video_layer_glx.h b/chrome/gpu/gpu_video_layer_glx.h
index 89d00b1..4b3497f 100644
--- a/chrome/gpu/gpu_video_layer_glx.h
+++ b/chrome/gpu/gpu_video_layer_glx.h
@@ -40,7 +40,8 @@ class GpuVideoLayerGLX : public IPC::Channel::Listener {
 
  private:
   // Message handlers.
-  void OnPaintToVideoLayer(TransportDIB::Handle dib_handle,
+  void OnPaintToVideoLayer(base::ProcessId source_process_id,
+                           TransportDIB::Id id,
                            const gfx::Rect& bitmap_rect);
 
   // Calculates vertices for |object| relative to |world|, where |world| is