Migrate PaymentRequestEvent to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: Ic7f0d09214a3b9df1064b333a464ea95f3df105e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2169449Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#766320}

third_party/blink/renderer/modules/payments/payment_request_event.cc

@@ -32,22 +32,16 @@
 
 namespace blink {
 
-PaymentRequestEvent* PaymentRequestEvent::Create(
-    const AtomicString& type,
-    const PaymentRequestEventInit* initializer) {
-  return MakeGarbageCollected<PaymentRequestEvent>(
-      type, initializer, mojo::NullRemote(), nullptr, nullptr);
-}
-
 PaymentRequestEvent* PaymentRequestEvent::Create(
     const AtomicString& type,
     const PaymentRequestEventInit* initializer,
     mojo::PendingRemote<payments::mojom::blink::PaymentHandlerHost> host,
     RespondWithObserver* respond_with_observer,
-    WaitUntilObserver* wait_until_observer) {
+    WaitUntilObserver* wait_until_observer,
+    ExecutionContext* execution_context) {
   return MakeGarbageCollected<PaymentRequestEvent>(
       type, initializer, std::move(host), respond_with_observer,
-      wait_until_observer);
+      wait_until_observer, execution_context);
 }
 
 PaymentRequestEvent::PaymentRequestEvent(
@@ -55,7 +49,8 @@ PaymentRequestEvent::PaymentRequestEvent(
     const PaymentRequestEventInit* initializer,
     mojo::PendingRemote<payments::mojom::blink::PaymentHandlerHost> host,
     RespondWithObserver* respond_with_observer,
-    WaitUntilObserver* wait_until_observer)
+    WaitUntilObserver* wait_until_observer,
+    ExecutionContext* execution_context)
     : ExtendableEvent(type, initializer, wait_until_observer),
       top_origin_(initializer->topOrigin()),
       payment_request_origin_(initializer->paymentRequestOrigin()),
@@ -75,13 +70,18 @@ PaymentRequestEvent::PaymentRequestEvent(
       shipping_options_(initializer->hasShippingOptions()
                             ? initializer->shippingOptions()
                             : HeapVector<Member<PaymentShippingOption>>()),
-      observer_(respond_with_observer) {
+      observer_(respond_with_observer),
+      payment_handler_host_(execution_context) {
   if (!host.is_valid())
     return;
 
-  payment_handler_host_.Bind(std::move(host));
-  payment_handler_host_.set_disconnect_handler(WTF::Bind(
-      &PaymentRequestEvent::OnHostConnectionError, WrapWeakPersistent(this)));
+  if (execution_context) {
+    payment_handler_host_.Bind(
+        std::move(host),
+        execution_context->GetTaskRunner(TaskType::kMiscPlatformAPI));
+    payment_handler_host_.set_disconnect_handler(WTF::Bind(
+        &PaymentRequestEvent::OnHostConnectionError, WrapWeakPersistent(this)));
+  }
 }
 
 PaymentRequestEvent::~PaymentRequestEvent() = default;
@@ -329,6 +329,7 @@ void PaymentRequestEvent::Trace(Visitor* visitor) {
   visitor->Trace(shipping_options_);
   visitor->Trace(change_payment_request_details_resolver_);
   visitor->Trace(observer_);
+  visitor->Trace(payment_handler_host_);
   ExtendableEvent::Trace(visitor);
 }
 

third_party/blink/renderer/modules/payments/payment_request_event.h

@@ -7,7 +7,6 @@
 
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/payments/payment_handler_host.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_value.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_address_init.h"
@@ -15,6 +14,8 @@
 #include "third_party/blink/renderer/modules/event_modules.h"
 #include "third_party/blink/renderer/modules/service_worker/extendable_event.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 
 namespace WTF {
 class AtomicString;
@@ -32,21 +33,22 @@ class MODULES_EXPORT PaymentRequestEvent final : public ExtendableEvent {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  static PaymentRequestEvent* Create(const AtomicString& type,
-                                     const PaymentRequestEventInit*);
   static PaymentRequestEvent* Create(
       const AtomicString& type,
       const PaymentRequestEventInit*,
-      mojo::PendingRemote<payments::mojom::blink::PaymentHandlerHost> host,
-      RespondWithObserver*,
-      WaitUntilObserver*);
+      mojo::PendingRemote<payments::mojom::blink::PaymentHandlerHost> host =
+          mojo::NullRemote(),
+      RespondWithObserver* respond_with_observer = nullptr,
+      WaitUntilObserver* wait_until_observer = nullptr,
+      ExecutionContext* execution_context = nullptr);
 
   PaymentRequestEvent(
       const AtomicString& type,
       const PaymentRequestEventInit*,
       mojo::PendingRemote<payments::mojom::blink::PaymentHandlerHost> host,
       RespondWithObserver*,
-      WaitUntilObserver*);
+      WaitUntilObserver*,
+      ExecutionContext* execution_context);
   ~PaymentRequestEvent() override;
 
   const AtomicString& InterfaceName() const override;
@@ -97,7 +99,8 @@ class MODULES_EXPORT PaymentRequestEvent final : public ExtendableEvent {
 
   Member<ScriptPromiseResolver> change_payment_request_details_resolver_;
   Member<RespondWithObserver> observer_;
-  mojo::Remote<payments::mojom::blink::PaymentHandlerHost>
+  HeapMojoRemote<payments::mojom::blink::PaymentHandlerHost,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
       payment_handler_host_;
 
   DISALLOW_COPY_AND_ASSIGN(PaymentRequestEvent);

third_party/blink/renderer/modules/service_worker/service_worker_global_scope.cc

@@ -2248,7 +2248,8 @@ void ServiceWorkerGlobalScope::StartPaymentRequestEvent(
       PaymentEventDataConversion::ToPaymentRequestEventInit(
           ScriptController()->GetScriptState(), std::move(event_data)),
       std::move(payment_handler_host), respond_with_observer,
-      wait_until_observer);
+      wait_until_observer,
+      ExecutionContext::From(ScriptController()->GetScriptState()));
 
   DispatchExtendableEventWithRespondWith(event, wait_until_observer,
                                          respond_with_observer);