1 files changed, 26 insertions, 9 deletions

diff --git a/chromium/gpu/command_buffer/service/dawn_service_memory_transfer_service.cc b/chromium/gpu/command_buffer/service/dawn_service_memory_transfer_service.cc
index 4f12f4d9f29..635e58962a3 100644
--- a/chromium/gpu/command_buffer/service/dawn_service_memory_transfer_service.cc
+++ b/chromium/gpu/command_buffer/service/dawn_service_memory_transfer_service.cc
@@ -6,6 +6,7 @@
 
 #include "base/memory/raw_ptr.h"
 #include "gpu/command_buffer/common/dawn_memory_transfer_handle.h"
+#include "gpu/command_buffer/service/command_buffer_service.h"
 #include "gpu/command_buffer/service/common_decoder.h"
 
 namespace gpu {
@@ -16,8 +17,8 @@ namespace {
 class ReadHandleImpl
     : public dawn::wire::server::MemoryTransferService::ReadHandle {
  public:
-  ReadHandleImpl(void* ptr, uint32_t size)
-      : ReadHandle(), ptr_(ptr), size_(size) {}
+  ReadHandleImpl(scoped_refptr<Buffer> buffer, void* ptr, uint32_t size)
+      : buffer_(std::move(buffer)), ptr_(ptr), size_(size) {}
 
   ~ReadHandleImpl() override = default;
 
@@ -44,6 +45,8 @@ class ReadHandleImpl
   }
 
  private:
+  scoped_refptr<gpu::Buffer> buffer_;
+  // Pointer to client-visible shared memory owned by buffer_.
   raw_ptr<void> ptr_;
   uint32_t size_;
 };
@@ -51,8 +54,8 @@ class ReadHandleImpl
 class WriteHandleImpl
     : public dawn::wire::server::MemoryTransferService::WriteHandle {
  public:
-  WriteHandleImpl(const void* ptr, uint32_t size)
-      : WriteHandle(), ptr_(ptr), size_(size) {}
+  WriteHandleImpl(scoped_refptr<Buffer> buffer, const void* ptr, uint32_t size)
+      : buffer_(std::move(buffer)), ptr_(ptr), size_(size) {}
 
   ~WriteHandleImpl() override = default;
 
@@ -82,7 +85,9 @@ class WriteHandleImpl
   }
 
  private:
-  raw_ptr<const void> ptr_;  // Pointer to client-visible shared memory.
+  scoped_refptr<gpu::Buffer> buffer_;
+  // Pointer to client-visible shared memory owned by buffer_.
+  raw_ptr<const void> ptr_;
   uint32_t size_;
 };
 
@@ -111,13 +116,19 @@ bool DawnServiceMemoryTransferService::DeserializeReadHandle(
   int32_t shm_id = handle->shm_id;
   uint32_t shm_offset = handle->shm_offset;
 
-  void* ptr = decoder_->GetAddressAndCheckSize(shm_id, shm_offset, size);
+  scoped_refptr<gpu::Buffer> buffer =
+      decoder_->command_buffer_service()->GetTransferBuffer(shm_id);
+  if (buffer == nullptr) {
+    return false;
+  }
+
+  void* ptr = buffer->GetDataAddress(shm_offset, size);
   if (ptr == nullptr) {
     return false;
   }
 
   DCHECK(read_handle);
-  *read_handle = new ReadHandleImpl(ptr, size);
+  *read_handle = new ReadHandleImpl(std::move(buffer), ptr, size);
 
   return true;
 }
@@ -139,13 +150,19 @@ bool DawnServiceMemoryTransferService::DeserializeWriteHandle(
   int32_t shm_id = handle->shm_id;
   uint32_t shm_offset = handle->shm_offset;
 
-  void* ptr = decoder_->GetAddressAndCheckSize(shm_id, shm_offset, size);
+  scoped_refptr<gpu::Buffer> buffer =
+      decoder_->command_buffer_service()->GetTransferBuffer(shm_id);
+  if (buffer == nullptr) {
+    return false;
+  }
+
+  const void* ptr = buffer->GetDataAddress(shm_offset, size);
   if (ptr == nullptr) {
     return false;
   }
 
   DCHECK(write_handle);
-  *write_handle = new WriteHandleImpl(ptr, size);
+  *write_handle = new WriteHandleImpl(std::move(buffer), ptr, size);
 
   return true;
 }