Migrate ApplicationCacheHost to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: I8b0881035d4ca718c2f973276bf4411356dbfbcb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2143888Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#759583}

third_party/blink/renderer/core/loader/appcache/application_cache_host.cc

@@ -63,8 +63,12 @@ const char* const kEventNames[] = {"Checking",    "Error",    "NoUpdate",
 
 ApplicationCacheHost::ApplicationCacheHost(
     const BrowserInterfaceBrokerProxy& interface_broker_proxy,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : task_runner_(std::move(task_runner)),
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+    ContextLifecycleNotifier* notifier)
+    : backend_host_(notifier),
+      receiver_(this, notifier),
+      backend_remote_(notifier),
+      task_runner_(std::move(task_runner)),
       interface_broker_proxy_(interface_broker_proxy) {}
 
 ApplicationCacheHost::~ApplicationCacheHost() = default;
@@ -230,6 +234,12 @@ void ApplicationCacheHost::ErrorEventRaised(
   }
 }
 
+void ApplicationCacheHost::Trace(Visitor* visitor) {
+  visitor->Trace(backend_host_);
+  visitor->Trace(receiver_);
+  visitor->Trace(backend_remote_);
+}
+
 void ApplicationCacheHost::GetAssociatedCacheInfo(
     ApplicationCacheHost::CacheInfo* info) {
   if (!backend_host_.is_bound())

third_party/blink/renderer/core/loader/appcache/application_cache_host.h

@@ -36,15 +36,17 @@
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom-blink.h"
 #include "third_party/blink/public/mojom/appcache/appcache_info.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom-blink-forward.h"
 #include "third_party/blink/renderer/core/core_export.h"
+#include "third_party/blink/renderer/platform/context_lifecycle_notifier.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/loader/fetch/resource_response.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 #include "third_party/blink/renderer/platform/weborigin/kurl.h"
 #include "third_party/blink/renderer/platform/wtf/allocator/allocator.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
@@ -57,7 +59,8 @@ class CORE_EXPORT ApplicationCacheHost
  public:
   ApplicationCacheHost(
       const BrowserInterfaceBrokerProxy& interface_broker_proxy,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+      ContextLifecycleNotifier* notifier);
   ~ApplicationCacheHost() override;
   virtual void Detach();
 
@@ -108,10 +111,12 @@ class CORE_EXPORT ApplicationCacheHost
       mojo::PendingRemote<network::mojom::blink::URLLoaderFactory>
           url_loader_factory) override {}
 
-  virtual void Trace(Visitor*) {}
+  virtual void Trace(Visitor*);
 
  protected:
-  mojo::Remote<mojom::blink::AppCacheHost> backend_host_;
+  HeapMojoRemote<mojom::blink::AppCacheHost,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      backend_host_;
   mojom::blink::AppCacheStatus status_ =
       mojom::blink::AppCacheStatus::APPCACHE_STATUS_UNCACHED;
 
@@ -129,8 +134,13 @@ class CORE_EXPORT ApplicationCacheHost
 
   void GetAssociatedCacheInfo(CacheInfo* info);
 
-  mojo::Receiver<mojom::blink::AppCacheFrontend> receiver_{this};
-  mojo::Remote<mojom::blink::AppCacheBackend> backend_remote_;
+  HeapMojoReceiver<mojom::blink::AppCacheFrontend,
+                   ApplicationCacheHost,
+                   HeapMojoWrapperMode::kWithoutContextObserver>
+      receiver_;
+  HeapMojoRemote<mojom::blink::AppCacheBackend,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
+      backend_remote_;
 
   base::UnguessableToken host_id_;
   mojom::blink::AppCacheInfo cache_info_;

third_party/blink/renderer/core/loader/appcache/application_cache_host_for_frame.cc

@@ -9,6 +9,7 @@
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/events/application_cache_error_event.h"
 #include "third_party/blink/renderer/core/events/progress_event.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame_client.h"
 #include "third_party/blink/renderer/core/frame/settings.h"
 #include "third_party/blink/renderer/core/inspector/console_message.h"
@@ -47,7 +48,9 @@ ApplicationCacheHostForFrame::ApplicationCacheHostForFrame(
     const BrowserInterfaceBrokerProxy& interface_broker_proxy,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
     const base::UnguessableToken& appcache_host_id)
-    : ApplicationCacheHost(interface_broker_proxy, std::move(task_runner)),
+    : ApplicationCacheHost(interface_broker_proxy,
+                           std::move(task_runner),
+                           document_loader->GetFrame()->DomWindow()),
       local_frame_(document_loader->GetFrame()),
       document_loader_(document_loader) {
   // PlzNavigate: The browser passes the ID to be used.

third_party/blink/renderer/core/loader/appcache/application_cache_host_for_worker.cc

@@ -9,8 +9,11 @@ namespace blink {
 ApplicationCacheHostForWorker::ApplicationCacheHostForWorker(
     const base::UnguessableToken& appcache_host_id,
     const BrowserInterfaceBrokerProxy& interface_broker_proxy,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : ApplicationCacheHost(interface_broker_proxy, std::move(task_runner)) {
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+    ContextLifecycleNotifier* notifier)
+    : ApplicationCacheHost(interface_broker_proxy,
+                           std::move(task_runner),
+                           notifier) {
   SetHostID(appcache_host_id ? appcache_host_id
                              : base::UnguessableToken::Create());
   BindBackend();

third_party/blink/renderer/core/loader/appcache/application_cache_host_for_worker.h

@@ -14,7 +14,8 @@ class ApplicationCacheHostForWorker final : public ApplicationCacheHost {
   ApplicationCacheHostForWorker(
       const base::UnguessableToken& appcache_host_id,
       const BrowserInterfaceBrokerProxy& interface_broker_proxy,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner,
+      ContextLifecycleNotifier* notifier);
   ~ApplicationCacheHostForWorker() override;
 };
 

third_party/blink/renderer/core/workers/shared_worker_global_scope.cc

@@ -60,7 +60,7 @@ SharedWorkerGlobalScope::SharedWorkerGlobalScope(
     : WorkerGlobalScope(std::move(creation_params), thread, time_origin) {
   appcache_host_ = MakeGarbageCollected<ApplicationCacheHostForWorker>(
       appcache_host_id, GetBrowserInterfaceBroker(),
-      GetTaskRunner(TaskType::kInternalLoading));
+      GetTaskRunner(TaskType::kInternalLoading), this);
 }
 
 SharedWorkerGlobalScope::~SharedWorkerGlobalScope() = default;