Migrate PaymentRequest to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: I420df20fa51681d3bfa3ee0c7ca20adf85681117
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2143414Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758485}

third_party/blink/renderer/modules/payments/payment_request.cc

@@ -847,7 +847,7 @@ ScriptPromise PaymentRequest::Retry(ScriptState* script_state,
     return ScriptPromise();
   }
 
-  if (!payment_provider_) {
+  if (!payment_provider_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
                                       "Payment request terminated");
     return ScriptPromise();
@@ -941,7 +941,7 @@ ScriptPromise PaymentRequest::Complete(ScriptState* script_state,
   }
 
   // User has cancelled the transaction while the website was processing it.
-  if (!payment_provider_) {
+  if (!payment_provider_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kAbortError,
                                       "Request cancelled");
     return ScriptPromise();
@@ -960,7 +960,7 @@ ScriptPromise PaymentRequest::Complete(ScriptState* script_state,
 void PaymentRequest::OnUpdatePaymentDetails(
     const ScriptValue& details_script_value) {
   ScriptPromiseResolver* resolver = GetPendingAcceptPromiseResolver();
-  if (!resolver || !payment_provider_ ||
+  if (!resolver || !payment_provider_.is_bound() ||
       !update_payment_details_timer_.IsActive()) {
     return;
   }
@@ -1011,7 +1011,7 @@ void PaymentRequest::OnUpdatePaymentDetails(
 }
 
 void PaymentRequest::OnUpdatePaymentDetailsFailure(const String& error) {
-  if (!payment_provider_)
+  if (!payment_provider_.is_bound())
     return;
   if (update_payment_details_timer_.IsActive())
     update_payment_details_timer_.Stop();
@@ -1041,6 +1041,8 @@ void PaymentRequest::Trace(Visitor* visitor) {
   visitor->Trace(abort_resolver_);
   visitor->Trace(can_make_payment_resolver_);
   visitor->Trace(has_enrolled_instrument_resolver_);
+  visitor->Trace(payment_provider_);
+  visitor->Trace(client_receiver_);
   EventTargetWithInlineData::Trace(visitor);
   ExecutionContextLifecycleObserver::Trace(visitor);
 }
@@ -1069,6 +1071,8 @@ PaymentRequest::PaymentRequest(
     ExceptionState& exception_state)
     : ExecutionContextLifecycleObserver(execution_context),
       options_(options),
+      payment_provider_(execution_context),
+      client_receiver_(this, execution_context),
       complete_timer_(
           execution_context->GetTaskRunner(TaskType::kMiscPlatformAPI),
           this,

third_party/blink/renderer/modules/payments/payment_request.h

@@ -8,8 +8,6 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "components/payments/mojom/payment_request_data.mojom-blink-forward.h"
-#include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/payments/payment_request.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/bindings/core/v8/script_promise.h"
@@ -23,6 +21,8 @@
 #include "third_party/blink/renderer/modules/payments/payment_state_resolver.h"
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
 #include "third_party/blink/renderer/platform/timer.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
@@ -47,6 +47,7 @@ class MODULES_EXPORT PaymentRequest final
       public ActiveScriptWrappable<PaymentRequest> {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(PaymentRequest);
+  // TODO(chikamune): remove this line after code freeze.
   USING_PRE_FINALIZER(PaymentRequest, ClearResolversAndCloseMojoConnection);
 
  public:
@@ -172,9 +173,9 @@ class MODULES_EXPORT PaymentRequest final
   Member<ScriptPromiseResolver> abort_resolver_;
   Member<ScriptPromiseResolver> can_make_payment_resolver_;
   Member<ScriptPromiseResolver> has_enrolled_instrument_resolver_;
-  mojo::Remote<payments::mojom::blink::PaymentRequest> payment_provider_;
-  mojo::Receiver<payments::mojom::blink::PaymentRequestClient> client_receiver_{
-      this};
+  HeapMojoRemote<payments::mojom::blink::PaymentRequest> payment_provider_;
+  HeapMojoReceiver<payments::mojom::blink::PaymentRequestClient, PaymentRequest>
+      client_receiver_;
   TaskRunnerTimer<PaymentRequest> complete_timer_;
   TaskRunnerTimer<PaymentRequest> update_payment_details_timer_;
   bool is_waiting_for_show_promise_to_resolve_;