[Backport] CVE-2025-1426: Heap buffer overflow in GPU

Cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/6258068:
M132: Check query IDs before removing from active_queries_

glDeleteQueries was removing queries from active_queries_ if they
matched the type of query being deleted. It also needed to check that
the ID matches.

This would cause issues later when the real active query was ended and
did not exist in the map.

(cherry picked from commit d8747107c91751884bdc5a297b29e6ba1785e7e5)

Bug: 383465163
Change-Id: I1ea9d1b053324dbe86c8dceadd9e3b8aa2b41c64
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6226546
Reviewed-by: Zhenyao Mo <[email protected]>
Commit-Queue: Geoff Lang <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#1416160}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6258068
Cr-Commit-Position: refs/branch-heads/6834@{#5225}
Cr-Branched-From: 47a3549fac11ee8cb7be6606001ede605b302b9f-refs/heads/main@{#1381561}
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/626260
Reviewed-by: Anu Aliyas <[email protected]>

Author: vonture

chromium/gpu/command_buffer/service/gles2_cmd_decoder_passthrough_doers.cc

@@ -3843,8 +3843,10 @@ error::Error GLES2DecoderPassthroughImpl::DoDeleteQueriesEXT(
       continue;
     }
 
-    if (base::Contains(active_queries_, query_info.type)) {
-      active_queries_.erase(query_info.type);
+    auto active_query_iter = active_queries_.find(query_info.type);
+    if (active_query_iter != active_queries_.end() &&
+        active_query_iter->second.service_id == query_service_id) {
+      active_queries_.erase(active_query_iter);
     }
 
     RemovePendingQuery(query_service_id);
@@ -4030,7 +4032,7 @@ error::Error GLES2DecoderPassthroughImpl::DoEndQueryEXT(GLenum target,
     }
   }
 
-  DCHECK(active_queries_.find(target) != active_queries_.end());
+  CHECK(base::Contains(active_queries_, target));
   ActiveQuery active_query = std::move(active_queries_[target]);
   active_queries_.erase(target);