MSE-in-Workers: Passkey-restrict STMSAttachment ctor

Uses a util::PassKey<URLMediaSource> instance to statically ensure that
only a URLMediaSource can construct that passkey, and therefore can
control that it is the only creator of a
SameThreadMediaSourceAttachment.

BUG=878133

Change-Id: I50bd7669a68113478b42950e74a59c9112623794
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2427207
Commit-Queue: Matthew Wolenetz <wolenetz@chromium.org>
Reviewed-by: Will Cassella <cassew@google.com>
Cr-Commit-Position: refs/heads/master@{#809960}

third_party/blink/renderer/modules/mediasource/same_thread_media_source_attachment.cc

@@ -32,7 +32,8 @@ blink::HTMLMediaElement* GetMediaElement(blink::MediaSourceTracer* tracer) {
 namespace blink {
 
 SameThreadMediaSourceAttachment::SameThreadMediaSourceAttachment(
-    MediaSource* media_source)
+    MediaSource* media_source,
+    util::PassKey<URLMediaSource> /* passkey */)
     : MediaSourceAttachmentSupplement(media_source),
       recent_element_time_(0.0),
       element_has_error_(false),

third_party/blink/renderer/modules/mediasource/same_thread_media_source_attachment.h

@@ -7,9 +7,11 @@
 
 #include <memory>
 
+#include "base/util/type_safety/pass_key.h"
 #include "third_party/blink/public/platform/web_time_range.h"
 #include "third_party/blink/renderer/modules/mediasource/media_source.h"
 #include "third_party/blink/renderer/modules/mediasource/media_source_attachment_supplement.h"
+#include "third_party/blink/renderer/modules/mediasource/url_media_source.h"
 
 namespace blink {
 
@@ -18,9 +20,11 @@ class SameThreadMediaSourceAttachment final
     : public MediaSourceAttachmentSupplement {
  public:
   // The only intended caller of this constructor is
-  // URLMediaSource::createObjectUrl. The raw pointer is then adopted into a
-  // scoped_refptr in SameThreadMediaSourceRegistry::RegisterURL.
-  explicit SameThreadMediaSourceAttachment(MediaSource* media_source);
+  // URLMediaSource::createObjectUrl, made more clear by using the PassKey. The
+  // raw pointer is then adopted into a scoped_refptr in
+  // SameThreadMediaSourceRegistry::RegisterURL.
+  SameThreadMediaSourceAttachment(MediaSource* media_source,
+                                  util::PassKey<URLMediaSource>);
 
   // MediaSourceAttachmentSupplement
   void NotifyDurationChanged(MediaSourceTracer* tracer, double duration) final;

third_party/blink/renderer/modules/mediasource/url_media_source.cc

@@ -60,11 +60,12 @@ String URLMediaSource::createObjectURL(ScriptState* script_state,
   // immediately. It will be adopted into a scoped_refptr in
   // MediaSourceRegistryImpl::RegisterURL. See also MediaSourceAttachment (and
   // usage in HTMLMediaElement, MediaSourceRegistry{Impl}, and MediaSource) for
-  // further detail.
+  // further detail. Passkey usage statically ensures that only we can call the
+  // attachment constructor.
   // TODO(https://crbug.com/878133): Support creation of a cross-thread
   // attachment.
   MediaSourceAttachment* attachment =
-      new SameThreadMediaSourceAttachment(source);
+      new SameThreadMediaSourceAttachment(source, PassKey());
   DCHECK(attachment->HasOneRef());
 
   String url = DOMURL::CreatePublicURL(execution_context, attachment);

third_party/blink/renderer/modules/mediasource/url_media_source.h

@@ -31,6 +31,7 @@
 #ifndef THIRD_PARTY_BLINK_RENDERER_MODULES_MEDIASOURCE_URL_MEDIA_SOURCE_H_
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_MEDIASOURCE_URL_MEDIA_SOURCE_H_
 
+#include "base/util/type_safety/pass_key.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 
@@ -43,6 +44,7 @@ class URLMediaSource {
   STATIC_ONLY(URLMediaSource);
 
  public:
+  using PassKey = util::PassKey<URLMediaSource>;
   static String createObjectURL(ScriptState*, MediaSource*);
 };