Migrate UserMediaProcessor to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: I04ef04b855f76ca92e5403a2c2f6e559643f6943
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2167799Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770060}

third_party/blink/renderer/modules/mediastream/user_media_controller.cc

@@ -51,6 +51,7 @@ void UserMediaController::Trace(Visitor* visitor) const {
 UserMediaClient* UserMediaController::Client() {
   auto* window = To<LocalDOMWindow>(GetExecutionContext());
   if (!client_ && window) {
+    DCHECK(window->GetFrame());
     client_ = MakeGarbageCollected<UserMediaClient>(
         window->GetFrame(), window->GetTaskRunner(TaskType::kInternalMedia));
   }

third_party/blink/renderer/modules/mediastream/user_media_processor.cc

@@ -31,6 +31,7 @@
 #include "third_party/blink/public/web/modules/mediastream/web_media_stream_device_observer.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_local_frame_client.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/page/chrome_client.h"
 #include "third_party/blink/renderer/modules/mediastream/local_media_stream_audio_source.h"
@@ -540,7 +541,8 @@ UserMediaProcessor::UserMediaProcessor(
     LocalFrame* frame,
     MediaDevicesDispatcherCallback media_devices_dispatcher_cb,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : media_devices_dispatcher_cb_(std::move(media_devices_dispatcher_cb)),
+    : dispatcher_host_(frame->DomWindow()),
+      media_devices_dispatcher_cb_(std::move(media_devices_dispatcher_cb)),
       frame_(frame),
       task_runner_(std::move(task_runner)) {}
 
@@ -1183,6 +1185,7 @@ void UserMediaProcessor::OnDeviceChanged(const MediaStreamDevice& old_device,
 }
 
 void UserMediaProcessor::Trace(Visitor* visitor) const {
+  visitor->Trace(dispatcher_host_);
   visitor->Trace(frame_);
   visitor->Trace(current_request_info_);
 }
@@ -1795,9 +1798,9 @@ bool UserMediaProcessor::HasActiveSources() const {
 
 blink::mojom::blink::MediaStreamDispatcherHost*
 UserMediaProcessor::GetMediaStreamDispatcherHost() {
-  if (!dispatcher_host_) {
+  if (!dispatcher_host_.is_bound()) {
     frame_->GetBrowserInterfaceBroker().GetInterface(
-        dispatcher_host_.BindNewPipeAndPassReceiver());
+        dispatcher_host_.BindNewPipeAndPassReceiver(task_runner_));
   }
   return dispatcher_host_.get();
 }

third_party/blink/renderer/modules/mediastream/user_media_processor.h

@@ -12,7 +12,6 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/threading/thread_checker.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "third_party/blink/public/mojom/mediastream/media_devices.mojom-blink.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom-blink.h"
@@ -20,6 +19,8 @@
 #include "third_party/blink/renderer/modules/mediastream/media_stream_constraints_util_audio.h"
 #include "third_party/blink/renderer/modules/mediastream/user_media_request.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
@@ -90,7 +91,7 @@ class MODULES_EXPORT UserMediaProcessor
   void set_media_stream_dispatcher_host_for_testing(
       mojo::PendingRemote<blink::mojom::blink::MediaStreamDispatcherHost>
           dispatcher_host) {
-    dispatcher_host_.Bind(std::move(dispatcher_host));
+    dispatcher_host_.Bind(std::move(dispatcher_host), task_runner_);
   }
 
   void Trace(Visitor*) const;
@@ -283,7 +284,9 @@ class MODULES_EXPORT UserMediaProcessor
   LocalStreamSources local_sources_;
   LocalStreamSources pending_local_sources_;
 
-  mojo::Remote<blink::mojom::blink::MediaStreamDispatcherHost> dispatcher_host_;
+  HeapMojoRemote<blink::mojom::blink::MediaStreamDispatcherHost,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      dispatcher_host_;
 
   // UserMedia requests are processed sequentially. |current_request_info_|
   // contains the request currently being processed.