Migrate BeginFrameProvider to use GC mojo wrappers

Migrates BeginFrameProvider to use HeapMojoReceiver/HeapMojoRemote to
reduce potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: Iecd9a91da7a8cc2fb741645da8bc22fe8d477a64
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2145746Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Yuki Yamada <yukiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758798}

third_party/blink/renderer/core/animation_frame/worker_animation_frame_provider.cc

@@ -16,7 +16,8 @@ WorkerAnimationFrameProvider::WorkerAnimationFrameProvider(
     const BeginFrameProviderParams& begin_frame_provider_params)
     : begin_frame_provider_(
           MakeGarbageCollected<BeginFrameProvider>(begin_frame_provider_params,
-                                                   this)),
+                                                   this,
+                                                   context)),
       callback_collection_(context),
       context_(context) {}
 

third_party/blink/renderer/platform/graphics/begin_frame_provider.cc

@@ -18,11 +18,15 @@ namespace blink {
 
 BeginFrameProvider::BeginFrameProvider(
     const BeginFrameProviderParams& begin_frame_provider_params,
-    BeginFrameProviderClient* client)
+    BeginFrameProviderClient* client,
+    ContextLifecycleNotifier* context)
     : needs_begin_frame_(false),
       requested_needs_begin_frame_(false),
+      cfs_receiver_(this, context),
+      efs_receiver_(this, context),
       frame_sink_id_(begin_frame_provider_params.frame_sink_id),
       parent_frame_sink_id_(begin_frame_provider_params.parent_frame_sink_id),
+      compositor_frame_sink_(context),
       begin_frame_client_(client) {}
 
 void BeginFrameProvider::ResetCompositorFrameSink() {
@@ -74,9 +78,9 @@ void BeginFrameProvider::CreateCompositorFrameSinkIfNeeded() {
       parent_frame_sink_id_, frame_sink_id_,
       efs_receiver_.BindNewPipeAndPassRemote(task_runner),
       cfs_receiver_.BindNewPipeAndPassRemote(task_runner),
-      compositor_frame_sink_.BindNewPipeAndPassReceiver());
+      compositor_frame_sink_.BindNewPipeAndPassReceiver(task_runner));
 
-  compositor_frame_sink_.set_disconnect_with_reason_handler(base::BindOnce(
+  compositor_frame_sink_.set_disconnect_with_reason_handler(WTF::Bind(
       &BeginFrameProvider::OnMojoConnectionError, WrapWeakPersistent(this)));
 }
 
@@ -121,6 +125,9 @@ void BeginFrameProvider::FinishBeginFrame(const viz::BeginFrameArgs& args) {
 }
 
 void BeginFrameProvider::Trace(Visitor* visitor) {
+  visitor->Trace(cfs_receiver_);
+  visitor->Trace(efs_receiver_);
+  visitor->Trace(compositor_frame_sink_);
   visitor->Trace(begin_frame_client_);
 }
 

third_party/blink/renderer/platform/graphics/begin_frame_provider.h

@@ -13,6 +13,8 @@
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom-blink.h"
 #include "third_party/blink/public/mojom/frame_sinks/embedded_frame_sink.mojom-blink.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
 #include "third_party/blink/renderer/platform/platform_export.h"
 
 namespace blink {
@@ -35,7 +37,8 @@ class PLATFORM_EXPORT BeginFrameProvider
  public:
   explicit BeginFrameProvider(
       const BeginFrameProviderParams& begin_frame_provider_params,
-      BeginFrameProviderClient*);
+      BeginFrameProviderClient*,
+      ContextLifecycleNotifier*);
 
   void CreateCompositorFrameSinkIfNeeded();
 
@@ -77,12 +80,20 @@ class PLATFORM_EXPORT BeginFrameProvider
   bool needs_begin_frame_;
   bool requested_needs_begin_frame_;
 
-  mojo::Receiver<viz::mojom::blink::CompositorFrameSinkClient> cfs_receiver_{
-      this};
-  mojo::Receiver<mojom::blink::EmbeddedFrameSinkClient> efs_receiver_{this};
+  HeapMojoReceiver<viz::mojom::blink::CompositorFrameSinkClient,
+                   BeginFrameProvider,
+                   HeapMojoWrapperMode::kWithoutContextObserver>
+      cfs_receiver_;
+
+  HeapMojoReceiver<mojom::blink::EmbeddedFrameSinkClient,
+                   BeginFrameProvider,
+                   HeapMojoWrapperMode::kWithoutContextObserver>
+      efs_receiver_;
   viz::FrameSinkId frame_sink_id_;
   viz::FrameSinkId parent_frame_sink_id_;
-  mojo::Remote<viz::mojom::blink::CompositorFrameSink> compositor_frame_sink_;
+  HeapMojoRemote<viz::mojom::blink::CompositorFrameSink,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      compositor_frame_sink_;
   Member<BeginFrameProviderClient> begin_frame_client_;
 };