Migrate SerialPort to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: I65e2e168c67edd2ffd2363479164f1a4e027c4b1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2135646Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#756246}

third_party/blink/renderer/modules/serial/serial_port.cc

@@ -159,7 +159,10 @@ class AbortCloseFunction : public ScriptFunction {
 }  // namespace
 
 SerialPort::SerialPort(Serial* parent, mojom::blink::SerialPortInfoPtr info)
-    : info_(std::move(info)), parent_(parent) {}
+    : info_(std::move(info)),
+      parent_(parent),
+      port_(GetExecutionContext()),
+      client_receiver_(this, GetExecutionContext()) {}
 
 SerialPort::~SerialPort() = default;
 
@@ -173,7 +176,7 @@ ScriptPromise SerialPort::open(ScriptState* script_state,
     return ScriptPromise();
   }
 
-  if (port_) {
+  if (port_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
                                       "The port is already open.");
     return ScriptPromise();
@@ -262,7 +265,10 @@ ScriptPromise SerialPort::open(ScriptState* script_state,
   }
 
   mojo::PendingRemote<device::mojom::blink::SerialPortClient> client;
-  parent_->GetPort(info_->token, port_.BindNewPipeAndPassReceiver());
+  parent_->GetPort(
+      info_->token,
+      port_.BindNewPipeAndPassReceiver(
+          GetExecutionContext()->GetTaskRunner(TaskType::kMiscPlatformAPI)));
   port_.set_disconnect_handler(
       WTF::Bind(&SerialPort::OnConnectionError, WrapWeakPersistent(this)));
 
@@ -282,7 +288,7 @@ ReadableStream* SerialPort::readable(ScriptState* script_state,
   if (readable_)
     return readable_;
 
-  if (!port_ || open_resolver_ || closing_ || read_fatal_)
+  if (!port_.is_bound() || open_resolver_ || closing_ || read_fatal_)
     return nullptr;
 
   mojo::ScopedDataPipeConsumerHandle readable_pipe;
@@ -303,7 +309,7 @@ WritableStream* SerialPort::writable(ScriptState* script_state,
   if (writable_)
     return writable_;
 
-  if (!port_ || open_resolver_ || closing_ || write_fatal_)
+  if (!port_.is_bound() || open_resolver_ || closing_ || write_fatal_)
     return nullptr;
 
   mojo::ScopedDataPipeProducerHandle writable_pipe;
@@ -321,7 +327,7 @@ WritableStream* SerialPort::writable(ScriptState* script_state,
 
 ScriptPromise SerialPort::getSignals(ScriptState* script_state,
                                      ExceptionState& exception_state) {
-  if (!port_) {
+  if (!port_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
                                       kPortClosed);
     return ScriptPromise();
@@ -338,7 +344,7 @@ ScriptPromise SerialPort::getSignals(ScriptState* script_state,
 ScriptPromise SerialPort::setSignals(ScriptState* script_state,
                                      const SerialOutputSignals* signals,
                                      ExceptionState& exception_state) {
-  if (!port_) {
+  if (!port_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
                                       kPortClosed);
     return ScriptPromise();
@@ -369,7 +375,7 @@ ScriptPromise SerialPort::setSignals(ScriptState* script_state,
 
 ScriptPromise SerialPort::close(ScriptState* script_state,
                                 ExceptionState& exception_state) {
-  if (!port_) {
+  if (!port_.is_bound()) {
     exception_state.ThrowDOMException(DOMExceptionCode::kInvalidStateError,
                                       "The port is already closed.");
     return ScriptPromise();
@@ -415,7 +421,7 @@ ScriptPromise SerialPort::ContinueClose(ScriptState* script_state) {
   DCHECK(!writable_);
   DCHECK(!close_resolver_);
 
-  if (!port_)
+  if (!port_.is_bound())
     return ScriptPromise::CastUndefined(script_state);
 
   close_resolver_ = MakeGarbageCollected<ScriptPromiseResolver>(script_state);
@@ -445,6 +451,8 @@ void SerialPort::ContextDestroyed() {
 
 void SerialPort::Trace(Visitor* visitor) {
   visitor->Trace(parent_);
+  visitor->Trace(port_);
+  visitor->Trace(client_receiver_);
   visitor->Trace(readable_);
   visitor->Trace(underlying_source_);
   visitor->Trace(writable_);
@@ -455,12 +463,6 @@ void SerialPort::Trace(Visitor* visitor) {
   ScriptWrappable::Trace(visitor);
 }
 
-void SerialPort::Dispose() {
-  // The binding holds a raw pointer to this object which must be released when
-  // it becomes garbage.
-  client_receiver_.reset();
-}
-
 ExecutionContext* SerialPort::GetExecutionContext() const {
   return parent_->GetExecutionContext();
 }
@@ -564,7 +566,9 @@ void SerialPort::OnOpen(
   ScriptState::Scope scope(script_state);
   InitializeReadableStream(script_state, std::move(readable_pipe));
   InitializeWritableStream(script_state, std::move(writable_pipe));
-  client_receiver_.Bind(std::move(client_receiver));
+  client_receiver_.Bind(
+      std::move(client_receiver),
+      GetExecutionContext()->GetTaskRunner(TaskType::kMiscPlatformAPI));
   open_resolver_->Resolve();
   open_resolver_ = nullptr;
 }

third_party/blink/renderer/modules/serial/serial_port.h

@@ -6,8 +6,6 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_SERIAL_SERIAL_PORT_H_
 
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/mojom/serial.mojom-blink-forward.h"
 #include "third_party/blink/public/mojom/serial/serial.mojom-blink.h"
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
@@ -15,6 +13,9 @@
 #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/heap/heap_allocator.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_wrapper_mode.h"
 
 namespace base {
 class UnguessableToken;
@@ -37,7 +38,6 @@ class SerialPort final : public ScriptWrappable,
                          public device::mojom::blink::SerialPortClient {
   DEFINE_WRAPPERTYPEINFO();
   USING_GARBAGE_COLLECTED_MIXIN(SerialPort);
-  USING_PRE_FINALIZER(SerialPort, Dispose);
 
  public:
   explicit SerialPort(Serial* parent, mojom::blink::SerialPortInfoPtr info);
@@ -64,7 +64,6 @@ class SerialPort final : public ScriptWrappable,
 
   void ContextDestroyed();
   void Trace(Visitor*) override;
-  void Dispose();
 
   // ActiveScriptWrappable
   ExecutionContext* GetExecutionContext() const;
@@ -95,8 +94,10 @@ class SerialPort final : public ScriptWrappable,
   const Member<Serial> parent_;
 
   uint32_t buffer_size_ = 0;
-  mojo::Remote<device::mojom::blink::SerialPort> port_;
-  mojo::Receiver<device::mojom::blink::SerialPortClient> client_receiver_{this};
+  HeapMojoRemote<device::mojom::blink::SerialPort> port_;
+  HeapMojoReceiver<device::mojom::blink::SerialPortClient,
+                   HeapMojoWrapperMode::kWithoutContextObserver>
+      client_receiver_;
 
   Member<ReadableStream> readable_;
   Member<SerialPortUnderlyingSource> underlying_source_;