3 files changed, 33 insertions, 11 deletions
diff --git a/chrome/renderer/render_process.h b/chrome/renderer/render_process.h
index 49f43e2..9ecbb13 100644
--- a/chrome/renderer/render_process.h
+++ b/chrome/renderer/render_process.h
@@ -63,6 +63,9 @@ class RenderProcess : public ChildProcess {
   // this function to free the SharedMemory object.
   static void FreeSharedMemory(SharedMemory* mem);
 
+  // Deletes the shared memory allocated by AllocSharedMemory.
+  static void DeleteSharedMem(SharedMemory* mem);
+
  private:
   friend class ChildProcessFactory<RenderProcess>;
   RenderProcess(const std::wstring& channel_name);
@@ -83,10 +86,6 @@ class RenderProcess : public ChildProcess {
 
   static ChildProcess* ClassFactory(const std::wstring& channel_name);
 
-  // This is here so consumers will use FreeSharedMemory instead.  A destructor
-  // on SharedMemory would be too tempting.
-  static void DeleteSharedMem(SharedMemory* mem);
-
   // Look in the shared memory cache for a suitable object to reuse.  Returns
   // NULL if there is none.
   SharedMemory* GetSharedMemFromCache(size_t size);
diff --git a/chrome/renderer/render_widget.cc b/chrome/renderer/render_widget.cc
index c5db805..2560438 100644
--- a/chrome/renderer/render_widget.cc
+++ b/chrome/renderer/render_widget.cc
@@ -182,6 +182,7 @@ IPC_DEFINE_MESSAGE_MAP(RenderWidget)
   IPC_MESSAGE_HANDLER(ViewMsg_SetFocus, OnSetFocus)
   IPC_MESSAGE_HANDLER(ViewMsg_ImeSetInputMode, OnImeSetInputMode)
   IPC_MESSAGE_HANDLER(ViewMsg_ImeSetComposition, OnImeSetComposition)
+  IPC_MESSAGE_HANDLER(ViewMsg_Repaint, OnMsgRepaint)
   IPC_MESSAGE_UNHANDLED_ERROR()
 IPC_END_MESSAGE_MAP()
 
@@ -295,17 +296,24 @@ void RenderWidget::OnWasRestored(bool needs_repainting) {
   DidInvalidateRect(webwidget_, gfx::Rect(size_.width(), size_.height()));
 }
 
-void RenderWidget::OnPaintRectAck() {
+void RenderWidget::OnPaintRectAck(bool drop_bitmap) {
   DCHECK(paint_reply_pending());
   paint_reply_pending_ = false;
 
-  // If we sent a PaintRect message with a zero-sized bitmap, then
-  // we should have no current paint buf.
-  if (current_paint_buf_) {
-    RenderProcess::FreeSharedMemory(current_paint_buf_);
-    current_paint_buf_ = NULL;
+  if (drop_bitmap) {
+    if (current_paint_buf_) {
+      RenderProcess::DeleteSharedMem(current_paint_buf_);
+    }
+  } else {
+    // If we sent a PaintRect message with a zero-sized bitmap, then
+    // we should have no current paint buf.
+    if (current_paint_buf_) {
+      RenderProcess::FreeSharedMemory(current_paint_buf_);
+    }
   }
 
+  current_paint_buf_ = NULL;
+
   // Continue painting if necessary...
   DoDeferredPaint();
 }
@@ -691,6 +699,16 @@ void RenderWidget::OnImeSetComposition(int string_type,
   }
 }
 
+void RenderWidget::OnMsgRepaint(const gfx::Size& size_to_paint) {
+  // During shutdown we can just ignore this message.
+  if (!webwidget_)
+    return;
+
+  set_next_paint_is_repaint_ack();
+  gfx::Rect repaint_rect(size_to_paint.width(), size_to_paint.height());
+  DidInvalidateRect(webwidget_, repaint_rect);
+}
+
 void RenderWidget::UpdateIME() {
   // If a browser process does not have IMEs, its IMEs are not active, or there
   // are not any attached widgets.
diff --git a/chrome/renderer/render_widget.h b/chrome/renderer/render_widget.h
index 720df07..48b40ee 100644
--- a/chrome/renderer/render_widget.h
+++ b/chrome/renderer/render_widget.h
@@ -133,7 +133,7 @@ class RenderWidget : public IPC::Channel::Listener,
   void OnResize(const gfx::Size& new_size);
   void OnWasHidden();
   void OnWasRestored(bool needs_repainting);
-  void OnPaintRectAck();
+  void OnPaintRectAck(bool drop_bitmap);
   void OnScrollRectAck();
   void OnHandleInputEvent(const IPC::Message& message);
   void OnMouseCaptureLost();
@@ -142,6 +142,7 @@ class RenderWidget : public IPC::Channel::Listener,
   void OnImeSetComposition(int string_type, int cursor_position,
                            int target_start, int target_end,
                            const std::wstring& ime_string);
+  void OnMsgRepaint(const gfx::Size& size_to_paint);
 
   // True if a PaintRect_ACK message is pending.
   bool paint_reply_pending() const {
@@ -169,6 +170,10 @@ class RenderWidget : public IPC::Channel::Listener,
     next_paint_flags_ |= ViewHostMsg_PaintRect_Flags::IS_RESTORE_ACK;
   }
 
+  void set_next_paint_is_repaint_ack() {
+    next_paint_flags_ |= ViewHostMsg_PaintRect_Flags::IS_REPAINT_ACK;
+  }
+
   // Called when a renderer process moves an input focus or updates the
   // position of its caret.
   // This function compares them with the previous values, and send them to