desktopCapture/getDisplayMedia: Check that the shared tab is valid.

On tab sharing, return TAB_CAPTURE_FAILURE if the media_id does not
contain a valid tab.

Bug: 1078254
Change-Id: Ia9586670f9e8460a47c5486115e2a5e32512cb5a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2209104
Commit-Queue: Marina Ciocea <marinaciocea@chromium.org>
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Cr-Commit-Position: refs/heads/master@{#770252}

chrome/browser/media/webrtc/desktop_capture_access_handler.cc

@@ -296,6 +296,7 @@ void DesktopCaptureAccessHandler::HandleRequest(
     const content::MediaStreamRequest& request,
     content::MediaResponseCallback callback,
     const extensions::Extension* extension) {
+  DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   blink::MediaStreamDevices devices;
   std::unique_ptr<content::MediaStreamUI> ui;
 
@@ -379,6 +380,17 @@ void DesktopCaptureAccessHandler::HandleRequest(
   }
 #endif
 
+  if (media_id.type == content::DesktopMediaID::TYPE_WEB_CONTENTS &&
+      !content::WebContents::FromRenderFrameHost(
+          content::RenderFrameHost::FromID(
+              media_id.web_contents_id.render_process_id,
+              media_id.web_contents_id.main_render_frame_id))) {
+    std::move(callback).Run(
+        devices, blink::mojom::MediaStreamRequestResult::TAB_CAPTURE_FAILURE,
+        std::move(ui));
+    return;
+  }
+
   bool loopback_audio_supported = false;
 #if defined(USE_CRAS) || defined(OS_WIN)
   // Currently loopback audio capture is supported only on Windows and ChromeOS.

chrome/browser/media/webrtc/display_media_access_handler.cc

@@ -225,6 +225,14 @@ void DisplayMediaAccessHandler::OnPickerDialogResults(
           blink::mojom::MediaStreamRequestResult::SYSTEM_PERMISSION_DENIED;
     }
 #endif
+    if (media_id.type == content::DesktopMediaID::TYPE_WEB_CONTENTS &&
+        !content::WebContents::FromRenderFrameHost(
+            content::RenderFrameHost::FromID(
+                media_id.web_contents_id.render_process_id,
+                media_id.web_contents_id.main_render_frame_id))) {
+      request_result =
+          blink::mojom::MediaStreamRequestResult::TAB_CAPTURE_FAILURE;
+    }
     if (request_result == blink::mojom::MediaStreamRequestResult::OK) {
       const auto& visible_url = url_formatter::FormatUrlForSecurityDisplay(
           web_contents->GetLastCommittedURL(),