diff --git a/gpu/command_buffer/service/shared_image/compound_image_backing.cc b/gpu/command_buffer/service/shared_image/compound_image_backing.cc index fce45e5cdb637..64ff7a2db5033 100644 --- a/gpu/command_buffer/service/shared_image/compound_image_backing.cc +++ b/gpu/command_buffer/service/shared_image/compound_image_backing.cc @@ -1601,6 +1601,12 @@ const std::vector& CompoundImageBacking::GetSharedMemoryPixmaps() { AutoLock auto_lock(this); auto* shm_backing = GetShmElement().GetBacking(); DCHECK(shm_backing); + // SECURITY: When kUseCompoundImageBackingAsDefault is on, WrapExternalBacking + // wraps arbitrary backing types and gives them AccessStreamSet::All() + // (including kMemory). GetShmElement() then returns that wrapped backing + // here regardless of its actual type. Guard against the resulting type + // confusion in the static_cast below. + CHECK_EQ(shm_backing->GetType(), SharedImageBackingType::kSharedMemory); return static_cast(shm_backing)->pixmaps(); }