Migrate ImageCapture to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: Ic6be109302b4c199ddae5726ee7b4f857a0c98e9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2145740Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758504}

third_party/blink/renderer/modules/imagecapture/image_capture.cc

@@ -126,7 +126,7 @@ ScriptPromise ImageCapture::getPhotoCapabilities(ScriptState* script_state) {
   auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
   ScriptPromise promise = resolver->Promise();
 
-  if (!service_) {
+  if (!service_.is_bound()) {
     resolver->Reject(MakeGarbageCollected<DOMException>(
         DOMExceptionCode::kNotFoundError, kNoServiceError));
     return promise;
@@ -152,7 +152,7 @@ ScriptPromise ImageCapture::getPhotoSettings(ScriptState* script_state) {
   auto* resolver = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
   ScriptPromise promise = resolver->Promise();
 
-  if (!service_) {
+  if (!service_.is_bound()) {
     resolver->Reject(MakeGarbageCollected<DOMException>(
         DOMExceptionCode::kNotFoundError, kNoServiceError));
     return promise;
@@ -189,7 +189,7 @@ ScriptPromise ImageCapture::setOptions(ScriptState* script_state,
     return promise;
   }
 
-  if (!service_) {
+  if (!service_.is_bound()) {
     resolver->Reject(MakeGarbageCollected<DOMException>(
         DOMExceptionCode::kNotFoundError, kNoServiceError));
     return promise;
@@ -269,7 +269,7 @@ ScriptPromise ImageCapture::takePhoto(ScriptState* script_state) {
         "The associated Track is in an invalid state."));
     return promise;
   }
-  if (!service_) {
+  if (!service_.is_bound()) {
     resolver->Reject(MakeGarbageCollected<DOMException>(
         DOMExceptionCode::kNotFoundError, kNoServiceError));
     return promise;
@@ -343,7 +343,7 @@ void ImageCapture::SetMediaTrackConstraints(
     ScriptPromiseResolver* resolver,
     const HeapVector<Member<MediaTrackConstraintSet>>& constraints_vector) {
   DCHECK_GT(constraints_vector.size(), 0u);
-  if (!service_) {
+  if (!service_.is_bound()) {
     resolver->Reject(MakeGarbageCollected<DOMException>(
         DOMExceptionCode::kNotFoundError, kNoServiceError));
     return;
@@ -691,6 +691,7 @@ void ImageCapture::GetMediaTrackSettings(MediaTrackSettings* settings) const {
 ImageCapture::ImageCapture(ExecutionContext* context, MediaStreamTrack* track)
     : ExecutionContextLifecycleObserver(context),
       stream_track_(track),
+      service_(context),
       capabilities_(MediaTrackCapabilities::Create()),
       settings_(MediaTrackSettings::Create()),
       current_constraints_(MediaTrackConstraintSet::Create()),
@@ -704,7 +705,8 @@ ImageCapture::ImageCapture(ExecutionContext* context, MediaStreamTrack* track)
     return;
 
   GetFrame()->GetBrowserInterfaceBroker().GetInterface(
-      service_.BindNewPipeAndPassReceiver());
+      service_.BindNewPipeAndPassReceiver(
+          context->GetTaskRunner(TaskType::kDOMManipulation)));
 
   service_.set_disconnect_handler(WTF::Bind(
       &ImageCapture::OnServiceConnectionError, WrapWeakPersistent(this)));
@@ -957,6 +959,7 @@ void ImageCapture::ResolveWithPhotoCapabilities(
 
 void ImageCapture::Trace(Visitor* visitor) {
   visitor->Trace(stream_track_);
+  visitor->Trace(service_);
   visitor->Trace(capabilities_);
   visitor->Trace(settings_);
   visitor->Trace(photo_settings_);

third_party/blink/renderer/modules/imagecapture/image_capture.h

@@ -7,7 +7,6 @@
 
 #include <memory>
 #include "media/capture/mojom/image_capture.mojom-blink.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
 #include "third_party/blink/renderer/bindings/modules/v8/v8_media_track_capabilities.h"
@@ -18,6 +17,8 @@
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
 #include "third_party/blink/renderer/modules/event_target_modules.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 
 namespace blink {
 
@@ -100,7 +101,9 @@ class MODULES_EXPORT ImageCapture final
 
   Member<MediaStreamTrack> stream_track_;
   std::unique_ptr<ImageCaptureFrameGrabber> frame_grabber_;
-  mojo::Remote<media::mojom::blink::ImageCapture> service_;
+  HeapMojoRemote<media::mojom::blink::ImageCapture,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      service_;
 
   Member<MediaTrackCapabilities> capabilities_;
   Member<MediaTrackSettings> settings_;