From 7500f1d78b8c1e52dff6a3966e65c3eafa104d64 Mon Sep 17 00:00:00 2001
From: Gregg Tavares <[email protected]>
Date: Mon, 16 Mar 2026 18:04:27 -0700
Subject: [PATCH] Fix Use-After-Free with GL MapBufferRange with shadow buf

When MapBufferRange is called on a readback-usage buffer,
it returns a subspan of the shadow buffer allocation.
This subspan pointer (base + offset) was being passed to
FreePendingToken during UnmapBuffer, causing the FencedAllocator
to misidentify and erroneously free the next adjacent memory block.

This change ensures that shadow-mapped buffers are correctly
unmapped via UnmapReadbackShm, which uses the correct base pointer.
Added null checks for shadow buffer lookups to handle cases where a
buffer mapping is tracked but the shadow buffer has been destroyed.

Added regression tests:
- UnmapBufferWithOffsetFreesCorrectBlock: Verifies that unmapping a
  shadow buffer with an offset does not free adjacent blocks.
  This was crashing before the fix.
- ReadbackShadowMixedCleanup: Verifies that multiple shadow mappings
  with various offsets are correctly cleaned up.

Added coverage tests:
- ClearMappedBufferRangeMapShadow: Verifies ClearMappedBufferRangeMap
  correctly unmaps shadow readback buffers.
- ClearMappedBufferMap: Verifies ClearMappedBufferMap correctly frees
  transfer buffers mapped via MapBufferSubDataCHROMIUM.
- AllocateShadowCopiesForReadbackNullBuffer: Verifies that
  AllocateShadowCopiesForReadback safely skips buffers that were
  deleted before being fenced, preventing a null pointer dereference.
- AllocateShadowCopiesForReadbackAllocFail: Verifies that
  AllocateShadowCopiesForReadback handles memory allocation failures
  gracefully by skipping the shadow allocation instead of issuing a
  command with an invalid shared memory ID.
- AllocateShadowCopiesForReadbackAlreadyAllocated: Verifies that
  AllocateShadowCopiesForReadback issues a performance warning if a
  READ-usage buffer is written to multiple times before being fenced.
- ReadbackBufferShadowTrackerTest.AllocFails: Verifies that the shadow
  tracker correctly handles internal allocation failures from
  MappedMemoryManager.

Bug: 492228019
Change-Id: I8e12ffd1ed4356609e7aeeef1552e81e250ae7bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7667030
Reviewed-by: Kenneth Russell <[email protected]>
Commit-Queue: Gregg Tavares <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1600244}
---

diff --git a/gpu/BUILD.gn b/gpu/BUILD.gn
index e181de63..2f916f0 100644
--- a/gpu/BUILD.gn
+++ b/gpu/BUILD.gn
@@ -414,6 +414,7 @@
     "command_buffer/client/query_tracker_unittest.cc",
     "command_buffer/client/raster_implementation_unittest.cc",
     "command_buffer/client/raster_implementation_unittest_autogen.h",
+    "command_buffer/client/readback_buffer_shadow_tracker_unittest.cc",
     "command_buffer/client/ring_buffer_test.cc",
     "command_buffer/client/shared_image_pool_unittest.cc",
     "command_buffer/client/transfer_buffer_cmd_copy_helpers_unittest.cc",
diff --git a/gpu/command_buffer/client/gles2_implementation.cc b/gpu/command_buffer/client/gles2_implementation.cc
index 019e750b..8c2c404 100644
--- a/gpu/command_buffer/client/gles2_implementation.cc
+++ b/gpu/command_buffer/client/gles2_implementation.cc
@@ -5603,8 +5603,19 @@
     auto iter = mapped_buffer_range_map_.find(buffer);
     if (iter != mapped_buffer_range_map_.end() &&
         !iter->second.shm_memory.empty()) {
-      mapped_memory_->FreePendingToken(iter->second.shm_memory.data(),
-                                       helper_->InsertToken());
+      if (iter->second.shm_id != 0) {
+        // This was a normal transfer buffer allocation.
+        mapped_memory_->FreePendingToken(iter->second.shm_memory.data(),
+                                         helper_->InsertToken());
+      } else {
+        // This was a shadow copy for readback. It's owned by the
+        // readback_buffer_shadow_tracker_, so we just need to unmap it.
+        auto* shadow_buffer =
+            readback_buffer_shadow_tracker_->GetBuffer(iter->first);
+        if (shadow_buffer) {
+          shadow_buffer->UnmapReadbackShm();
+        }
+      }
       mapped_buffer_range_map_.erase(iter);
     }
   }
@@ -5613,8 +5624,19 @@
 void GLES2Implementation::ClearMappedBufferRangeMap() {
   for (auto& buffer_range : mapped_buffer_range_map_) {
     if (!buffer_range.second.shm_memory.empty()) {
-      mapped_memory_->FreePendingToken(buffer_range.second.shm_memory.data(),
-                                       helper_->InsertToken());
+      if (buffer_range.second.shm_id != 0) {
+        // This was a normal transfer buffer allocation.
+        mapped_memory_->FreePendingToken(buffer_range.second.shm_memory.data(),
+                                         helper_->InsertToken());
+      } else {
+        // This was a shadow copy for readback. It's owned by the
+        // readback_buffer_shadow_tracker_, so we just need to unmap it.
+        auto* shadow_buffer =
+            readback_buffer_shadow_tracker_->GetBuffer(buffer_range.first);
+        if (shadow_buffer) {
+          shadow_buffer->UnmapReadbackShm();
+        }
+      }
     }
   }
   mapped_buffer_range_map_.clear();
@@ -6200,10 +6222,13 @@
     if (!buffer) {
       continue;
     }
-    int32_t shm_id = 0;
+    int32_t shm_id = -1;
     uint32_t shm_offset = 0;
     bool already_allocated = false;
     uint32_t size = buffer->Alloc(&shm_id, &shm_offset, &already_allocated);
+    if (shm_id == -1) {
+      continue;
+    }
     if (already_allocated) {
       SendErrorMessage(
           "performance warning: READ-usage buffer was written, then "
diff --git a/gpu/command_buffer/client/gles2_implementation_unittest.cc b/gpu/command_buffer/client/gles2_implementation_unittest.cc
index 3e4fde9..e7e8e081 100644
--- a/gpu/command_buffer/client/gles2_implementation_unittest.cc
+++ b/gpu/command_buffer/client/gles2_implementation_unittest.cc
@@ -436,6 +436,12 @@
     return gl_->max_extra_transfer_buffer_size_ > 0;
   }
 
+  void SetQueryProcessCount(QueryTracker::Query* q, int32_t count) {
+    q->info_.sync->process_count = count;
+  }
+
+  MappedMemoryManager* mapped_memory() { return gl_->mapped_memory_.get(); }
+
   static SharedMemoryLimits SharedMemoryLimitsForTesting() {
     SharedMemoryLimits limits;
     limits.command_buffer_size = kCommandBufferSizeBytes;
@@ -3922,6 +3928,232 @@
   UNSAFE_TODO(EXPECT_EQ(0, memcmp(&expected, commands_, sizeof(expected))));
 }
 
+// Test that UnmapBuffer on a readback buffer with a non-zero offset
+// doesn't erroneously free adjacent blocks in FencedAllocator.
+// This is a regression test for a use-after-free bug.
+TEST_F(GLES2ImplementationTest, UnmapBufferWithOffsetFreesCorrectBlock) {
+  // Create two readback buffers.
+  std::array<GLuint, 2> buffers;
+  gl_->GenBuffers(buffers.size(), buffers.data());
+
+  const GLsizeiptr kBufferSize = 64;
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  gl_->BufferData(GL_ARRAY_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  gl_->BufferData(GL_ARRAY_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+
+  // Trigger shadow copy allocation by starting a readback query.
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+
+  // We need to satisfy the expectations for BeginQueryEXT
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  gl_->EndQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM);
+
+  // Simulate query completion to update tracker serials.
+  QueryTracker::Query* q = GetQuery(query);
+  ASSERT_TRUE(q);
+  // Mark as processed by service
+  SetQueryProcessCount(q, q->submit_count());
+  // Trigger callback
+  bool flush_if_pending = false;
+  EXPECT_TRUE(q->CheckResultsAvailable(helper_, flush_if_pending));
+
+  // Map buffer 1 at offset 0.
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  void* addr2 = gl_->MapBufferRange(GL_ARRAY_BUFFER, 0, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr2);
+
+  // Map buffer 0 with non-zero offset.
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  const GLintptr kOffset = 16;
+  void* addr1_with_offset =
+      gl_->MapBufferRange(GL_ARRAY_BUFFER, kOffset, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr1_with_offset);
+
+  // Unmap buffer 0.
+  // If the bug exists, this will erroneously free the block for buffer 1
+  // because it calls FreePendingToken with addr1_with_offset, and
+  // FencedAllocator::GetBlockByOffset(16) will resolve to the next block
+  // (buffer 1).
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+
+  // Check if buffer 1's shadow memory was incorrectly freed.
+  int32_t token = 0;

diff --git a/gpu/command_buffer/client/gles2_implementation_unittest.cc b/gpu/command_buffer/client/gles2_implementation_unittest.cc
index 3e4fde9..e7e8e081 100644
--- a/gpu/command_buffer/client/gles2_implementation_unittest.cc
+++ b/gpu/command_buffer/client/gles2_implementation_unittest.cc
@@ -436,6 +436,12 @@
     return gl_->max_extra_transfer_buffer_size_ > 0;
   }
 
+  void SetQueryProcessCount(QueryTracker::Query* q, int32_t count) {
+    q->info_.sync->process_count = count;
+  }
+
+  MappedMemoryManager* mapped_memory() { return gl_->mapped_memory_.get(); }
+
   static SharedMemoryLimits SharedMemoryLimitsForTesting() {
     SharedMemoryLimits limits;
     limits.command_buffer_size = kCommandBufferSizeBytes;
@@ -3922,6 +3928,232 @@
   UNSAFE_TODO(EXPECT_EQ(0, memcmp(&expected, commands_, sizeof(expected))));
 }
 
+// Test that UnmapBuffer on a readback buffer with a non-zero offset
+// doesn't erroneously free adjacent blocks in FencedAllocator.
+// This is a regression test for a use-after-free bug.
+TEST_F(GLES2ImplementationTest, UnmapBufferWithOffsetFreesCorrectBlock) {
+  // Create two readback buffers.
+  std::array<GLuint, 2> buffers;
+  gl_->GenBuffers(buffers.size(), buffers.data());
+
+  const GLsizeiptr kBufferSize = 64;
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  gl_->BufferData(GL_ARRAY_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  gl_->BufferData(GL_ARRAY_BUFFER, kBufferSize, nullptr, GL_STREAM_READ);
+
+  // Trigger shadow copy allocation by starting a readback query.
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+
+  // We need to satisfy the expectations for BeginQueryEXT
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  gl_->EndQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM);
+
+  // Simulate query completion to update tracker serials.
+  QueryTracker::Query* q = GetQuery(query);
+  ASSERT_TRUE(q);
+  // Mark as processed by service
+  SetQueryProcessCount(q, q->submit_count());
+  // Trigger callback
+  bool flush_if_pending = false;
+  EXPECT_TRUE(q->CheckResultsAvailable(helper_, flush_if_pending));
+
+  // Map buffer 1 at offset 0.
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  void* addr2 = gl_->MapBufferRange(GL_ARRAY_BUFFER, 0, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr2);
+
+  // Map buffer 0 with non-zero offset.
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  const GLintptr kOffset = 16;
+  void* addr1_with_offset =
+      gl_->MapBufferRange(GL_ARRAY_BUFFER, kOffset, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr1_with_offset);
+
+  // Unmap buffer 0.
+  // If the bug exists, this will erroneously free the block for buffer 1
+  // because it calls FreePendingToken with addr1_with_offset, and
+  // FencedAllocator::GetBlockByOffset(16) will resolve to the next block
+  // (buffer 1).
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+
+  // Check if buffer 1's shadow memory was incorrectly freed.
+  int32_t token = 0;
+  FencedAllocator::State state2 =
+      mapped_memory()->GetPointerStatusForTest(addr2, &token);
+  EXPECT_EQ(FencedAllocator::IN_USE, state2);
+
+  // Clean up buffer 1
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+}
+
+// Test that deleting a buffer or clearing the mapping map correctly handles
+// shadow buffers without triggering misaligned frees.
+TEST_F(GLES2ImplementationTest, ReadbackShadowMixedCleanup) {
+  std::array<GLuint, 3> buffers;
+  gl_->GenBuffers(buffers.size(), buffers.data());
+
+  // Setup shadow buffers for all 3
+  for (auto buffer : buffers) {
+    gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+    gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STREAM_READ);
+  }
+
+  // Trigger shadow allocation
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  gl_->EndQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM);
+  QueryTracker::Query* q = GetQuery(query);
+  SetQueryProcessCount(q, q->submit_count());
+  bool flush_if_pending = false;
+  EXPECT_TRUE(q->CheckResultsAvailable(helper_, flush_if_pending));
+
+  // Create mixed mappings
+  // Buffer 0: Shadow, Offset 16
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  void* addr0 = gl_->MapBufferRange(GL_ARRAY_BUFFER, 16, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr0);
+
+  // Buffer 1: Shadow, Offset 0
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  void* addr1 = gl_->MapBufferRange(GL_ARRAY_BUFFER, 0, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr1);
+
+  // Buffer 2: Shadow, Offset 32
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[2]);
+  void* addr2 = gl_->MapBufferRange(GL_ARRAY_BUFFER, 32, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr2);
+
+  // Test unmapping a shadow-mapped buffer with offset
+  // This calls RemoveMappedBufferRangeById(buffers[0]) via UnmapBuffer
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[0]);
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+
+  // Test unmapping remaining shadow-mapped buffers
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[1]);
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffers[2]);
+  gl_->UnmapBuffer(GL_ARRAY_BUFFER);
+}
+
+// Test that ClearMappedBufferRangeMap correctly handles shadow-mapped buffers.
+TEST_F(GLES2ImplementationTest, ClearMappedBufferRangeMapShadow) {
+  GLuint buffer;
+  gl_->GenBuffers(1, &buffer);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+  gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STREAM_READ);
+
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  gl_->EndQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM);
+
+  // Simulate query completion
+  QueryTracker::Query* q = GetQuery(query);
+  ASSERT_TRUE(q);
+  SetQueryProcessCount(q, q->submit_count());
+  bool flush_if_pending = false;
+  EXPECT_TRUE(q->CheckResultsAvailable(helper_, flush_if_pending));
+
+  void* addr = gl_->MapBufferRange(GL_ARRAY_BUFFER, 0, 1, GL_MAP_READ_BIT);
+  ASSERT_TRUE(addr);
+}
+
+// Test that ClearMappedBufferMap correctly cleans up buffers mapped via
+// MapBufferSubDataCHROMIUM.
+TEST_F(GLES2ImplementationTest, ClearMappedBufferMap) {
+  GLuint buffer;
+  gl_->GenBuffers(1, &buffer);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+  gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STATIC_DRAW);
+
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  void* addr =
+      gl_->MapBufferSubDataCHROMIUM(GL_ARRAY_BUFFER, 0, 1, GL_WRITE_ONLY);
+  ASSERT_TRUE(addr);
+}
+
+// Test that AllocateShadowCopiesForReadback skips buffers that have been
+// deleted while in the unfenced list.
+TEST_F(GLES2ImplementationTest, AllocateShadowCopiesForReadbackNullBuffer) {
+  GLuint buffer;
+  gl_->GenBuffers(1, &buffer);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+  gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STREAM_READ);
+
+  gl_->DeleteBuffers(1, &buffer);
+
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  // Prior to the fix, this would crash in AllocateShadowCopiesForReadback
+  // because it would dereference a null WeakPtr for the deleted buffer.
+}
+
+// Test that AllocateShadowCopiesForReadback correctly handles shadow buffer
+// allocation failures.
+TEST_F(GLES2ImplementationTest, AllocateShadowCopiesForReadbackAllocFail) {
+  GLuint buffer;
+  gl_->GenBuffers(1, &buffer);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+  gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STREAM_READ);
+
+  mapped_memory()->set_max_allocated_bytes(0);
+
+  GLuint query;
+  gl_->GenQueriesEXT(1, &query);
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query);
+  // Prior to the fix, this would incorrectly attempt to issue a shadow
+  // allocation command with an invalid shared memory ID (-1).
+}
+
+// Test that AllocateShadowCopiesForReadback issues a performance warning if a
+// READ-usage buffer is written to again while a shadow copy is already
+// allocated.
+TEST_F(GLES2ImplementationTest,
+       AllocateShadowCopiesForReadbackAlreadyAllocated) {
+  GLuint buffer;
+  gl_->GenBuffers(1, &buffer);
+  gl_->BindBuffer(GL_ARRAY_BUFFER, buffer);
+  gl_->BufferData(GL_ARRAY_BUFFER, 64, nullptr, GL_STREAM_READ);
+
+  // Trigger first allocation
+  GLuint query1;
+  gl_->GenQueriesEXT(1, &query1);
+  EXPECT_CALL(*command_buffer(), OnFlush()).Times(testing::AnyNumber());
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query1);
+  gl_->EndQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM);
+
+  // Write again, adding back to unfenced list
+  const char data = 'a';
+  gl_->BufferSubData(GL_ARRAY_BUFFER, 0, 1, &data);
+
+  // Capture warning
+  std::string last_error;
+  gl_->SetErrorMessageCallback(
+      base::BindRepeating([](std::string* error, const char* message,
+                             int32_t id) { *error = message; },
+                          &last_error));
+
+  // Trigger second allocation
+  GLuint query2;
+  gl_->GenQueriesEXT(1, &query2);
+  gl_->BeginQueryEXT(GL_READBACK_SHADOW_COPIES_UPDATED_CHROMIUM, query2);
+
+  EXPECT_THAT(last_error,
+              testing::HasSubstr("READ-usage buffer was written, then fenced, "
+                                 "but written again"));
+}
+
 #include "gpu/command_buffer/client/gles2_implementation_unittest_autogen.h"
 
 }  // namespace gles2
diff --git a/gpu/command_buffer/client/readback_buffer_shadow_tracker_unittest.cc b/gpu/command_buffer/client/readback_buffer_shadow_tracker_unittest.cc
new file mode 100644
index 0000000..df174fcc
--- /dev/null
+++ b/gpu/command_buffer/client/readback_buffer_shadow_tracker_unittest.cc
@@ -0,0 +1,61 @@
+// Copyright 2026 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "gpu/command_buffer/client/readback_buffer_shadow_tracker.h"
+
+#include <memory>
+
+#include "gpu/command_buffer/client/client_test_helper.h"
+#include "gpu/command_buffer/client/gles2_cmd_helper.h"
+#include "gpu/command_buffer/client/mapped_memory.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace gpu::gles2 {
+
+class ReadbackBufferShadowTrackerTest : public testing::Test {
+ protected:
+  void SetUp() override {
+    command_buffer_ = std::make_unique<MockClientCommandBuffer>();
+    command_buffer_->DelegateToFake();
+    helper_ = std::make_unique<GLES2CmdHelper>(command_buffer_.get());
+    helper_->Initialize(1024);
+    EXPECT_CALL(*command_buffer_, DestroyTransferBuffer(testing::_))
+        .Times(testing::AnyNumber());
+    mapped_memory_ = std::make_unique<MappedMemoryManager>(helper_.get(), 1024);
+    tracker_ = std::make_unique<ReadbackBufferShadowTracker>(
+        mapped_memory_.get(), helper_.get());
+  }
+
+  std::unique_ptr<gpu::MockClientCommandBuffer> command_buffer_;
+  std::unique_ptr<GLES2CmdHelper> helper_;
+  std::unique_ptr<MappedMemoryManager> mapped_memory_;
+  std::unique_ptr<ReadbackBufferShadowTracker> tracker_;
+};
+
+// Test that ReadbackBufferShadowTracker::Buffer::Alloc correctly handles
+// MappedMemoryManager::Alloc failures.
+TEST_F(ReadbackBufferShadowTrackerTest, AllocFails) {
+  const GLuint kBufferId = 1;
+  const GLuint kSize = 64;
+  tracker_->GetOrCreateBuffer(kBufferId, kSize);
+
+  int32_t shm_id = 0;
... (truncated)