Fix issues with shadow buffer readback in the passthrough decoder.

 - Buffers were read back using the client ID instead of service ID.
 - Buffer ID was not validated in SetReadbackBufferShadowAllocationINTERNAL
 - Pending readbacks were not removed on buffer deletion once they were
   already associated with a query.

BUG=941930

Change-Id: I6220cd0f96be23113dd0e9bd6dc56dee8e49a137
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1525996
Reviewed-by: Kenneth Russell <kbr@chromium.org>
Reviewed-by: Kai Ninomiya <kainino@chromium.org>
Commit-Queue: Geoff Lang <geofflang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#642113}

gpu/command_buffer/service/gles2_cmd_decoder_passthrough.cc

@@ -2177,10 +2177,22 @@ void GLES2DecoderPassthroughImpl::RemovePendingQuery(GLuint service_id) {
 
 void GLES2DecoderPassthroughImpl::ReadBackBuffersIntoShadowCopies(
     const BufferShadowUpdateMap& updates) {
+  if (updates.empty()) {
+    return;
+  }
+
   GLint old_binding = 0;
   api()->glGetIntegervFn(GL_ARRAY_BUFFER_BINDING, &old_binding);
   for (const auto& u : updates) {
-    GLuint service_id = u.first;
+    GLuint client_id = u.first;
+    GLuint service_id = 0;
+    if (!resources_->buffer_id_map.GetServiceID(client_id, &service_id)) {
+      // Buffer no longer exists, this shadow update should have been removed by
+      // DoDeleteBuffers
+      DCHECK(false);
+      continue;
+    }
+
     const auto& update = u.second;
 
     void* shadow = update.shm->GetDataAddress(update.shm_offset, update.size);

gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

@@ -927,6 +927,9 @@ error::Error GLES2DecoderPassthroughImpl::DoDeleteBuffers(
       return update.first == client_id;
     };
     base::EraseIf(buffer_shadow_updates_, is_the_deleted_buffer);
+    for (PendingQuery& pending_query : pending_queries_) {
+      base::EraseIf(pending_query.buffer_shadow_updates, is_the_deleted_buffer);
+    }
   }
   api()->glDeleteBuffersARBFn(n, service_ids.data());
 
@@ -5077,6 +5080,12 @@ GLES2DecoderPassthroughImpl::DoSetReadbackBufferShadowAllocationINTERNAL(
   update.shm_offset = shm_offset;
   update.size = size;
 
+  GLuint buffer_service_id = 0;
+  if (!resources_->buffer_id_map.GetServiceID(buffer_id, &buffer_service_id)) {
+    InsertError(GL_INVALID_OPERATION, "Invalid buffer ID");
+    return error::kNoError;
+  }
+
   if (!update.shm) {
     return error::kInvalidArguments;
   }