WebXR: Validate view belongs to provided frame.

Validate the provided view for XrWebGLBinding::getCameraImage(...) is
contained within the provided frame.

Design Doc: https://docs.google.com/document/d/1X4zhSCYqzOKrbC4iGA5SOV983vmI0mqz9tQxRvyrYlk/edit?usp=sharing

Fixed: 1100978
Change-Id: I0177303e67d7ffc7da7a79d5b781d5f2b9b51959
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2315639
Commit-Queue: Luis Garcia <luisggarcia@google.com>
Reviewed-by: Piotr Bialecki <bialpio@chromium.org>
Reviewed-by: Klaus Weidner <klausw@chromium.org>
Cr-Commit-Position: refs/heads/master@{#791967}

third_party/blink/renderer/modules/xr/xr_frame.cc

@@ -47,7 +47,7 @@ XRFrame::XRFrame(XRSession* session, XRWorldInformation* world_information)
     : world_information_(world_information), session_(session) {}
 
 XRViewerPose* XRFrame::getViewerPose(XRReferenceSpace* reference_space,
-                                     ExceptionState& exception_state) const {
+                                     ExceptionState& exception_state) {
   DVLOG(3) << __func__;
   if (!is_active_) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
@@ -92,8 +92,7 @@ XRViewerPose* XRFrame::getViewerPose(XRReferenceSpace* reference_space,
     return nullptr;
   }
 
-  return MakeGarbageCollected<XRViewerPose>(session(),
-                                            *offset_space_from_viewer);
+  return MakeGarbageCollected<XRViewerPose>(this, *offset_space_from_viewer);
 }
 
 XRAnchorSet* XRFrame::trackedAnchors() const {

third_party/blink/renderer/modules/xr/xr_frame.h

@@ -42,7 +42,7 @@ class XRFrame final : public ScriptWrappable {
 
   XRSession* session() const { return session_; }
 
-  XRViewerPose* getViewerPose(XRReferenceSpace*, ExceptionState&) const;
+  XRViewerPose* getViewerPose(XRReferenceSpace*, ExceptionState&);
   XRPose* getPose(XRSpace*, XRSpace*, ExceptionState&);
   XRWorldInformation* worldInformation() const { return world_information_; }
   XRAnchorSet* trackedAnchors() const;

third_party/blink/renderer/modules/xr/xr_view.cc

@@ -5,14 +5,13 @@
 #include "third_party/blink/renderer/modules/xr/xr_view.h"
 
 #include "third_party/blink/renderer/modules/xr/xr_frame.h"
-#include "third_party/blink/renderer/modules/xr/xr_session.h"
 #include "third_party/blink/renderer/modules/xr/xr_utils.h"
 #include "third_party/blink/renderer/platform/geometry/float_point_3d.h"
 
 namespace blink {
 
-XRView::XRView(XRSession* session, const XRViewData& view_data)
-    : eye_(view_data.Eye()), session_(session) {
+XRView::XRView(XRFrame* frame, const XRViewData& view_data)
+    : eye_(view_data.Eye()), frame_(frame) {
   switch (eye_) {
     case kEyeLeft:
       eye_string_ = "left";
@@ -29,8 +28,12 @@ XRView::XRView(XRSession* session, const XRViewData& view_data)
       transformationMatrixToDOMFloat32Array(view_data.ProjectionMatrix());
 }
 
+XRFrame* XRView::frame() const {
+  return frame_;
+}
+
 XRSession* XRView::session() const {
-  return session_;
+  return frame_->session();
 }
 
 DOMFloat32Array* XRView::projectionMatrix() const {
@@ -142,7 +145,7 @@ XRRigidTransform* XRView::transform() const {
 }
 
 void XRView::Trace(Visitor* visitor) const {
-  visitor->Trace(session_);
+  visitor->Trace(frame_);
   visitor->Trace(projection_matrix_);
   visitor->Trace(ref_space_from_eye_);
   ScriptWrappable::Trace(visitor);

third_party/blink/renderer/modules/xr/xr_view.h

@@ -17,6 +17,7 @@
 
 namespace blink {
 
+class XRFrame;
 class XRSession;
 class XRViewData;
 
@@ -24,13 +25,14 @@ class MODULES_EXPORT XRView final : public ScriptWrappable {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  XRView(XRSession*, const XRViewData&);
+  XRView(XRFrame*, const XRViewData&);
 
   enum XREye { kEyeNone = 0, kEyeLeft = 1, kEyeRight = 2 };
 
   const String& eye() const { return eye_string_; }
   XREye EyeValue() const { return eye_; }
 
+  XRFrame* frame() const;
   XRSession* session() const;
   DOMFloat32Array* projectionMatrix() const;
   XRRigidTransform* transform() const;
@@ -47,7 +49,7 @@ class MODULES_EXPORT XRView final : public ScriptWrappable {
  private:
   XREye eye_;
   String eye_string_;
-  Member<XRSession> session_;
+  Member<XRFrame> frame_;
   Member<XRRigidTransform> ref_space_from_eye_;
   Member<DOMFloat32Array> projection_matrix_;
 };

third_party/blink/renderer/modules/xr/xr_viewer_pose.cc

@@ -4,23 +4,31 @@
 
 #include "third_party/blink/renderer/modules/xr/xr_viewer_pose.h"
 
+#include "third_party/blink/renderer/modules/xr/xr_frame.h"
 #include "third_party/blink/renderer/modules/xr/xr_rigid_transform.h"
 #include "third_party/blink/renderer/modules/xr/xr_session.h"
 #include "third_party/blink/renderer/modules/xr/xr_view.h"
 
 namespace blink {
 
-XRViewerPose::XRViewerPose(XRSession* session,
+XRViewerPose::XRViewerPose(XRFrame* frame,
                            const TransformationMatrix& pose_model_matrix)
-    : XRPose(pose_model_matrix, session->EmulatedPosition()) {
+    : XRPose(pose_model_matrix, frame->session()->EmulatedPosition()) {
   DVLOG(3) << __func__ << ": emulatedPosition()=" << emulatedPosition();
 
-  Vector<XRViewData>& view_data = session->views();
+  Vector<XRViewData>& view_data = frame->session()->views();
+
+  bool camera_access_enabled = frame->session()->IsFeatureEnabled(
+      device::mojom::XRSessionFeature::CAMERA_ACCESS);
 
   // Snapshot the session's current views.
   for (XRViewData& view : view_data) {
     view.UpdatePoseMatrix(transform_->TransformMatrix());
-    views_.push_back(MakeGarbageCollected<XRView>(session, view));
+    XRView* xr_view = MakeGarbageCollected<XRView>(frame, view);
+    views_.push_back(xr_view);
+    if (camera_access_enabled) {
+      camera_views_.push_back(xr_view);
+    }
   }
 }
 

third_party/blink/renderer/modules/xr/xr_viewer_pose.h

@@ -11,14 +11,14 @@
 
 namespace blink {
 
-class XRSession;
+class XRFrame;
 class XRView;
 
 class XRViewerPose final : public XRPose {
   DEFINE_WRAPPERTYPEINFO();
 
  public:
-  XRViewerPose(XRSession*, const TransformationMatrix&);
+  XRViewerPose(XRFrame*, const TransformationMatrix&);
   ~XRViewerPose() override = default;
 
   const HeapVector<Member<XRView>>& views() const { return views_; }

third_party/blink/renderer/modules/xr/xr_webgl_binding.cc

@@ -88,7 +88,9 @@ WebGLTexture* XRWebGLBinding::getCameraImage(XRFrame* frame, XRView* view) {
     return nullptr;
   }
 
-  // TODO(https://crbug.com/1100978): Verify view is in camera_views_.
+  if (frame != view->frame()) {
+    return nullptr;
+  }
 
   XRWebGLLayer* base_layer = view->session()->renderState()->baseLayer();
   DCHECK(base_layer);