Handle player_id reuse as bad mojo message

MediaPlayerId objects are supposed to be unique browser-wide. A
well-behaved renederer process will not try to reuse them.

Bug: 1168737
Change-Id: Iaa1d54face4bd475d6df8a00d282a5b88242b735
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2640381Reviewed-by: Chrome Cunningham <chcunningham@chromium.org>
Commit-Queue: Wojciech Dzierżanowski <wdzierzanowski@opera.com>
Cr-Commit-Position: refs/heads/master@{#845642}

content/browser/media/media_web_contents_observer.cc

@@ -19,6 +19,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "ipc/ipc_message_macros.h"
+#include "mojo/public/cpp/bindings/message.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/device/public/mojom/wake_lock_context.mojom.h"
 #include "services/media_session/public/cpp/media_position.h"
@@ -582,12 +583,11 @@ void MediaWebContentsObserver::BindMediaPlayerHost(
 void MediaWebContentsObserver::OnMediaPlayerAdded(
     mojo::PendingRemote<media::mojom::MediaPlayer> player_remote,
     MediaPlayerId player_id) {
-  if (!media_player_remotes_.contains(player_id)) {
-    media_player_remotes_[player_id] =
-        mojo::Remote<media::mojom::MediaPlayer>();
+  if (media_player_remotes_.contains(player_id)) {
+    mojo::ReportBadMessage("Unexpected player_id reuse");
+    return;
   }
 
-  media_player_remotes_[player_id].reset();
   media_player_remotes_[player_id].Bind(std::move(player_remote));
   media_player_remotes_[player_id].set_disconnect_handler(base::BindOnce(
       [](MediaWebContentsObserver* observer, const MediaPlayerId& player_id) {