Handle createCDM() when frame destroyed

createCDM() now uses WeakPtr<> so that it fails gracefully when the
frame is destroyed.

BUG=454278
TEST=fuzzed test doesn't crash

Review URL: https://codereview.chromium.org/886393003

Cr-Commit-Position: refs/heads/master@{#314417}

media/blink/webcontentdecryptionmoduleaccess_impl.cc

@@ -2,24 +2,31 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "webcontentdecryptionmoduleaccess_impl.h"
+#include "media/blink/webcontentdecryptionmoduleaccess_impl.h"
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/message_loop/message_loop_proxy.h"
-#include "third_party/WebKit/public/platform/WebContentDecryptionModuleResult.h"
-#include "webcontentdecryptionmodule_impl.h"
+#include "media/blink/webencryptedmediaclient_impl.h"
 
 namespace media {
 
 // The caller owns the created cdm (passed back using |result|).
-static void CreateCdm(CdmFactory* cdm_factory,
-                      blink::WebSecurityOrigin security_origin,
-                      blink::WebString key_system,
+static void CreateCdm(const base::WeakPtr<WebEncryptedMediaClientImpl>& client,
+                      const blink::WebString& key_system,
+                      const blink::WebSecurityOrigin& security_origin,
                       blink::WebContentDecryptionModuleResult result) {
-  WebContentDecryptionModuleImpl::Create(cdm_factory, security_origin,
-                                         key_system, result);
+  // If |client| is gone (due to the frame getting destroyed), it is
+  // impossible to create the CDM, so fail.
+  if (!client) {
+    result.completeWithError(
+        blink::WebContentDecryptionModuleExceptionInvalidStateError, 0,
+        "Failed to create CDM.");
+    return;
+  }
+
+  client->CreateCdm(key_system, security_origin, result);
 }
 
 WebContentDecryptionModuleAccessImpl*
@@ -27,20 +34,20 @@ WebContentDecryptionModuleAccessImpl::Create(
     const blink::WebString& key_system,
     const blink::WebMediaKeySystemConfiguration& configuration,
     const blink::WebSecurityOrigin& security_origin,
-    CdmFactory* cdm_factory) {
+    const base::WeakPtr<WebEncryptedMediaClientImpl>& client) {
   return new WebContentDecryptionModuleAccessImpl(key_system, configuration,
-                                                  security_origin, cdm_factory);
+                                                  security_origin, client);
 }
 
 WebContentDecryptionModuleAccessImpl::WebContentDecryptionModuleAccessImpl(
     const blink::WebString& key_system,
     const blink::WebMediaKeySystemConfiguration& configuration,
     const blink::WebSecurityOrigin& security_origin,
-    CdmFactory* cdm_factory)
+    const base::WeakPtr<WebEncryptedMediaClientImpl>& client)
     : key_system_(key_system),
       configuration_(configuration),
       security_origin_(security_origin),
-      cdm_factory_(cdm_factory) {
+      client_(client) {
 }
 
 WebContentDecryptionModuleAccessImpl::~WebContentDecryptionModuleAccessImpl() {
@@ -58,8 +65,8 @@ void WebContentDecryptionModuleAccessImpl::createContentDecryptionModule(
   // blink side, copy all values needed by CreateCdm() in case the blink object
   // gets garbage-collected.
   base::MessageLoopProxy::current()->PostTask(
-      FROM_HERE, base::Bind(&CreateCdm, cdm_factory_, security_origin_,
-                            key_system_, result));
+      FROM_HERE,
+      base::Bind(&CreateCdm, client_, key_system_, security_origin_, result));
 }
 
 }  // namespace media

media/blink/webcontentdecryptionmoduleaccess_impl.h

@@ -7,6 +7,7 @@
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "media/base/cdm_factory.h"
 #include "third_party/WebKit/public/platform/WebContentDecryptionModuleAccess.h"
 #include "third_party/WebKit/public/platform/WebMediaKeySystemConfiguration.h"
@@ -19,6 +20,8 @@ class WebLocalFrame;
 
 namespace media {
 
+class WebEncryptedMediaClientImpl;
+
 class WebContentDecryptionModuleAccessImpl
     : public blink::WebContentDecryptionModuleAccess {
  public:
@@ -26,7 +29,7 @@ class WebContentDecryptionModuleAccessImpl
       const blink::WebString& key_system,
       const blink::WebMediaKeySystemConfiguration& configuration,
       const blink::WebSecurityOrigin& security_origin,
-      CdmFactory* cdm_factory);
+      const base::WeakPtr<WebEncryptedMediaClientImpl>& client);
   virtual ~WebContentDecryptionModuleAccessImpl();
 
   // blink::WebContentDecryptionModuleAccess interface.
@@ -39,14 +42,16 @@ class WebContentDecryptionModuleAccessImpl
       const blink::WebString& key_system,
       const blink::WebMediaKeySystemConfiguration& configuration,
       const blink::WebSecurityOrigin& security_origin,
-      CdmFactory* cdm_factory);
+      const base::WeakPtr<WebEncryptedMediaClientImpl>& client);
 
   DISALLOW_COPY_AND_ASSIGN(WebContentDecryptionModuleAccessImpl);
 
   blink::WebString key_system_;
   blink::WebMediaKeySystemConfiguration configuration_;
   blink::WebSecurityOrigin security_origin_;
-  CdmFactory* cdm_factory_;
+
+  // Keep a WeakPtr as client is owned by render_frame_impl.
+  base::WeakPtr<WebEncryptedMediaClientImpl> client_;
 };
 
 }  // namespace media

media/blink/webencryptedmediaclient_impl.cc

@@ -15,6 +15,7 @@
 #include "third_party/WebKit/public/platform/WebMediaKeySystemConfiguration.h"
 #include "third_party/WebKit/public/platform/WebString.h"
 #include "third_party/WebKit/public/platform/WebVector.h"
+#include "webcontentdecryptionmodule_impl.h"
 #include "webcontentdecryptionmoduleaccess_impl.h"
 
 namespace media {
@@ -189,7 +190,7 @@ class WebEncryptedMediaClientImpl::Reporter {
 WebEncryptedMediaClientImpl::WebEncryptedMediaClientImpl(
     scoped_ptr<CdmFactory> cdm_factory,
     MediaPermission* media_permission)
-    : cdm_factory_(cdm_factory.Pass()) {
+    : cdm_factory_(cdm_factory.Pass()), weak_factory_(this) {
   // TODO(sandersd): Use |media_permission| to check for media permissions in
   // this class.
   DCHECK(media_permission);
@@ -237,7 +238,7 @@ void WebEncryptedMediaClientImpl::requestMediaKeySystemAccess(
     reporter->ReportSupported();
     request.requestSucceeded(WebContentDecryptionModuleAccessImpl::Create(
         request.keySystem(), blink::WebMediaKeySystemConfiguration(),
-        request.securityOrigin(), cdm_factory_.get()));
+        request.securityOrigin(), weak_factory_.GetWeakPtr()));
     return;
   }
 
@@ -250,7 +251,7 @@ void WebEncryptedMediaClientImpl::requestMediaKeySystemAccess(
       reporter->ReportSupported();
       request.requestSucceeded(WebContentDecryptionModuleAccessImpl::Create(
           request.keySystem(), accumulated_configuration,
-          request.securityOrigin(), cdm_factory_.get()));
+          request.securityOrigin(), weak_factory_.GetWeakPtr()));
       return;
     }
   }
@@ -260,6 +261,14 @@ void WebEncryptedMediaClientImpl::requestMediaKeySystemAccess(
       "None of the requested configurations were supported.");
 }
 
+void WebEncryptedMediaClientImpl::CreateCdm(
+    const blink::WebString& key_system,
+    const blink::WebSecurityOrigin& security_origin,
+    blink::WebContentDecryptionModuleResult result) {
+  WebContentDecryptionModuleImpl::Create(cdm_factory_.get(), security_origin,
+                                         key_system, result);
+}
+
 // Lazily create Reporters.
 WebEncryptedMediaClientImpl::Reporter* WebEncryptedMediaClientImpl::GetReporter(
     const std::string& key_system) {

media/blink/webencryptedmediaclient_impl.h

@@ -9,8 +9,10 @@
 
 #include "base/containers/scoped_ptr_hash_map.h"
 #include "base/memory/scoped_ptr.h"
+#include "base/memory/weak_ptr.h"
 #include "media/base/cdm_factory.h"
 #include "media/base/media_export.h"
+#include "third_party/WebKit/public/platform/WebContentDecryptionModuleResult.h"
 #include "third_party/WebKit/public/platform/WebEncryptedMediaClient.h"
 #include "third_party/WebKit/public/web/WebSecurityOrigin.h"
 
@@ -29,6 +31,12 @@ class MEDIA_EXPORT WebEncryptedMediaClientImpl
   virtual void requestMediaKeySystemAccess(
       blink::WebEncryptedMediaRequest request);
 
+  // Create the CDM for |key_system| and |security_origin|. The caller owns
+  // the created cdm (passed back using |result|).
+  void CreateCdm(const blink::WebString& key_system,
+                 const blink::WebSecurityOrigin& security_origin,
+                 blink::WebContentDecryptionModuleResult result);
+
  private:
   // Report usage of key system to UMA. There are 2 different counts logged:
   // 1. The key system is requested.
@@ -45,6 +53,8 @@ class MEDIA_EXPORT WebEncryptedMediaClientImpl
   Reporters reporters_;
 
   scoped_ptr<CdmFactory> cdm_factory_;
+
+  base::WeakPtrFactory<WebEncryptedMediaClientImpl> weak_factory_;
 };
 
 }  // namespace media