Code:  void RenderWidgetHostViewAura::InsertSyncPointAndACK(
    int32 route_id, int gpu_host_id, bool presented,
    ui::Compositor* compositor) {
   uint32 sync_point = 0;
  if (compositor) {
    ImageTransportFactory* factory = ImageTransportFactory::GetInstance();
    sync_point = factory->InsertSyncPoint();
   }
 
   RenderWidgetHostImpl::AcknowledgeBufferPresent(
      route_id, gpu_host_id, presented, sync_point);
 }

Vulnerability Type: 
CWE ID: 
Summary: Google Chrome before 25.0.1364.99 on Mac OS X does not properly implement signal handling for Native Client (aka NaCl) code, which has unspecified impact and attack vectors.
Commit Message: Implement TextureImageTransportSurface using texture mailbox

This has a couple of advantages:
- allow tearing down and recreating the UI parent context without
losing the renderer contexts
- do not require a context to be able to generate textures when
creating the GLSurfaceHandle
- clearer ownership semantics that potentially allows for more
robust and easier lost context handling/thumbnailing/etc., since a texture is at
any given time owned by either: UI parent, mailbox, or
TextureImageTransportSurface
- simplify frontbuffer protection logic;
the frontbuffer textures are now owned by RWHV where they are refcounted

The TextureImageTransportSurface informs RenderWidgetHostView of the
mailbox names for the front- and backbuffer textures by
associating them with a surface_handle (1 or 2) in the AcceleratedSurfaceNew message.
During SwapBuffers() or PostSubBuffer() cycles, it then uses 
produceTextureCHROMIUM() and consumeTextureCHROMIUM()
to transfer ownership between renderer and browser compositor.

RWHV sends back the surface_handle of the buffer being returned with the Swap ACK
(or 0 if no buffer is being returned in which case TextureImageTransportSurface will
allocate a new texture - note that this could be used to 
simply keep textures for thumbnailing).

BUG=154815,139616
TBR=sky@chromium.org

Review URL: https://chromiumcodereview.appspot.com/11194042

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@171569 0039d316-1c4b-4281-b951-d872f2087c98