Migrate SpeechRecognitionController to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: Iac720bf6eed6f24e55fc017ce97eb7e2e4e52f54
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2132078Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#756083}

third_party/blink/renderer/modules/speech/speech_recognition_controller.cc

@@ -29,6 +29,7 @@
 
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/modules/speech/speech_grammar_list.h"
 #include "third_party/blink/renderer/modules/speech/speech_recognition.h"
 #include "third_party/blink/renderer/platform/heap/heap.h"
@@ -39,7 +40,7 @@ const char SpeechRecognitionController::kSupplementName[] =
     "SpeechRecognitionController";
 
 SpeechRecognitionController::SpeechRecognitionController(LocalFrame& frame)
-    : Supplement<LocalFrame>(frame) {}
+    : Supplement<LocalFrame>(frame), speech_recognizer_(frame.DomWindow()) {}
 
 SpeechRecognitionController::~SpeechRecognitionController() {
   // FIXME: Call m_client->pageDestroyed(); once we have implemented a client.
@@ -72,18 +73,25 @@ void SpeechRecognitionController::Start(
   GetSpeechRecognizer()->Start(std::move(msg_params));
 }
 
+void SpeechRecognitionController::Trace(Visitor* visitor) {
+  Supplement::Trace(visitor);
+  visitor->Trace(speech_recognizer_);
+}
+
 void ProvideSpeechRecognitionTo(LocalFrame& frame) {
   SpeechRecognitionController::ProvideTo(
       frame, MakeGarbageCollected<SpeechRecognitionController>(frame));
 }
 
-mojo::Remote<mojom::blink::SpeechRecognizer>&
+mojom::blink::SpeechRecognizer*
 SpeechRecognitionController::GetSpeechRecognizer() {
-  if (!speech_recognizer_) {
+  if (!speech_recognizer_.is_bound()) {
     GetSupplementable()->GetBrowserInterfaceBroker().GetInterface(
-        speech_recognizer_.BindNewPipeAndPassReceiver());
+        speech_recognizer_.BindNewPipeAndPassReceiver(
+            GetSupplementable()->DomWindow()->GetTaskRunner(
+                TaskType::kMiscPlatformAPI)));
   }
-  return speech_recognizer_;
+  return speech_recognizer_.get();
 }
 
 }  // namespace blink

third_party/blink/renderer/modules/speech/speech_recognition_controller.h

@@ -30,10 +30,11 @@
 
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/speech/speech_recognizer.mojom-blink.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 
 namespace blink {
 
@@ -64,10 +65,14 @@ class SpeechRecognitionController final
     return Supplement<LocalFrame>::From<SpeechRecognitionController>(frame);
   }
 
+  void Trace(Visitor* visitor) override;
+
  private:
-  mojo::Remote<mojom::blink::SpeechRecognizer>& GetSpeechRecognizer();
+  mojom::blink::SpeechRecognizer* GetSpeechRecognizer();
 
-  mojo::Remote<mojom::blink::SpeechRecognizer> speech_recognizer_;
+  HeapMojoRemote<mojom::blink::SpeechRecognizer,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      speech_recognizer_;
 };
 
 MODULES_EXPORT void ProvideSpeechRecognitionTo(LocalFrame& frame);