BASELINE: Update Chromium to 72.0.3626.110 and Ninja to 1.9.0

Change-Id: Ic57220b00ecc929a893c91f5cc552f5d3e99e922
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

1 files changed, 22 insertions, 20 deletions

diff --git a/chromium/gpu/command_buffer/client/implementation_base.cc b/chromium/gpu/command_buffer/client/implementation_base.cc
index 41c7c3aafc9..e07e10ccf14 100644
--- a/chromium/gpu/command_buffer/client/implementation_base.cc
+++ b/chromium/gpu/command_buffer/client/implementation_base.cc
@@ -176,18 +176,10 @@ void ImplementationBase::WaitForCmd() {
   helper_->Finish();
 }
 
-void* ImplementationBase::GetResultBuffer() {
-  return transfer_buffer_->GetResultBuffer();
-}
-
 int32_t ImplementationBase::GetResultShmId() {
   return transfer_buffer_->GetShmId();
 }
 
-uint32_t ImplementationBase::GetResultShmOffset() {
-  return transfer_buffer_->GetResultOffset();
-}
-
 bool ImplementationBase::GetBucketContents(uint32_t bucket_id,
                                            std::vector<int8_t>* data) {
   TRACE_EVENT0("gpu", "ImplementationBase::GetBucketContents");
@@ -197,16 +189,22 @@ bool ImplementationBase::GetBucketContents(uint32_t bucket_id,
   if (!buffer.valid()) {
     return false;
   }
-  typedef cmd::GetBucketStart::Result Result;
-  Result* result = GetResultAs<Result*>();
-  if (!result) {
-    return false;
+  uint32_t size = 0;
+  {
+    // The Result pointer must be scoped to this block because it can be
+    // invalidated below if resizing the ScopedTransferBufferPtr causes the
+    // transfer buffer to be reallocated.
+    typedef cmd::GetBucketStart::Result Result;
+    auto result = GetResultAs<Result>();
+    if (!result) {
+      return false;
+    }
+    *result = 0;
+    helper_->GetBucketStart(bucket_id, GetResultShmId(), result.offset(),
+                            buffer.size(), buffer.shm_id(), buffer.offset());
+    WaitForCmd();
+    size = *result;
   }
-  *result = 0;
-  helper_->GetBucketStart(bucket_id, GetResultShmId(), GetResultShmOffset(),
-                          buffer.size(), buffer.shm_id(), buffer.offset());
-  WaitForCmd();
-  uint32_t size = *result;
   data->resize(size);
   if (size > 0u) {
     uint32_t offset = 0;
@@ -236,7 +234,7 @@ bool ImplementationBase::GetBucketContents(uint32_t bucket_id,
 
 void ImplementationBase::SetBucketContents(uint32_t bucket_id,
                                            const void* data,
-                                           size_t size) {
+                                           uint32_t size) {
   DCHECK(data);
   helper_->SetBucketSize(bucket_id, size);
   if (size > 0u) {
@@ -261,7 +259,9 @@ void ImplementationBase::SetBucketAsCString(uint32_t bucket_id,
   // NOTE: strings are passed NULL terminated. That means the empty
   // string will have a size of 1 and no-string will have a size of 0
   if (str) {
-    SetBucketContents(bucket_id, str, strlen(str) + 1);
+    base::CheckedNumeric<uint32_t> len = strlen(str);
+    len += 1;
+    SetBucketContents(bucket_id, str, len.ValueOrDefault(0));
   } else {
     helper_->SetBucketSize(bucket_id, 0);
   }
@@ -287,7 +287,9 @@ void ImplementationBase::SetBucketAsString(uint32_t bucket_id,
                                            const std::string& str) {
   // NOTE: strings are passed NULL terminated. That means the empty
   // string will have a size of 1 and no-string will have a size of 0
-  SetBucketContents(bucket_id, str.c_str(), str.size() + 1);
+  base::CheckedNumeric<uint32_t> len = str.size();
+  len += 1;
+  SetBucketContents(bucket_id, str.c_str(), len.ValueOrDefault(0));
 }
 
 bool ImplementationBase::GetVerifiedSyncTokenForIPC(