Migrate VibrationController to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: Icf65cb3d9e62f1eb51fddce41ff3dcadd6b637ab
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2108403Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#755268}

third_party/blink/renderer/modules/vibration/vibration_controller.cc

@@ -24,6 +24,7 @@
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/renderer/bindings/modules/v8/unsigned_long_or_unsigned_long_sequence.h"
 #include "third_party/blink/renderer/core/dom/document.h"
+#include "third_party/blink/renderer/core/frame/local_dom_window.h"
 #include "third_party/blink/renderer/core/frame/local_frame.h"
 #include "third_party/blink/renderer/core/frame/navigator.h"
 #include "third_party/blink/renderer/core/page/page.h"
@@ -78,6 +79,7 @@ VibrationController::SanitizeVibrationPattern(
 VibrationController::VibrationController(LocalFrame& frame)
     : ExecutionContextLifecycleObserver(frame.GetDocument()),
       PageVisibilityObserver(frame.GetDocument()->GetPage()),
+      vibration_manager_(frame.DomWindow()),
       timer_do_vibrate_(
           frame.GetDocument()->GetTaskRunner(TaskType::kMiscPlatformAPI),
           this,
@@ -86,7 +88,8 @@ VibrationController::VibrationController(LocalFrame& frame)
       is_calling_cancel_(false),
       is_calling_vibrate_(false) {
   frame.GetBrowserInterfaceBroker().GetInterface(
-      vibration_manager_.BindNewPipeAndPassReceiver());
+      vibration_manager_.BindNewPipeAndPassReceiver(
+          frame.GetDocument()->GetTaskRunner(TaskType::kMiscPlatformAPI)));
 }
 
 VibrationController::~VibrationController() = default;
@@ -126,7 +129,7 @@ void VibrationController::DoVibrate(TimerBase* timer) {
       !GetExecutionContext() || !GetPage()->IsPageVisible())
     return;
 
-  if (vibration_manager_) {
+  if (vibration_manager_.is_bound()) {
     is_calling_vibrate_ = true;
     vibration_manager_->Vibrate(
         pattern_[0],
@@ -160,7 +163,7 @@ void VibrationController::Cancel() {
   pattern_.clear();
   timer_do_vibrate_.Stop();
 
-  if (is_running_ && !is_calling_cancel_ && vibration_manager_) {
+  if (is_running_ && !is_calling_cancel_ && vibration_manager_.is_bound()) {
     is_calling_cancel_ = true;
     vibration_manager_->Cancel(
         WTF::Bind(&VibrationController::DidCancel, WrapPersistent(this)));
@@ -180,9 +183,6 @@ void VibrationController::DidCancel() {
 
 void VibrationController::ContextDestroyed() {
   Cancel();
-
-  // If the document context was destroyed, never call the mojo service again.
-  vibration_manager_.reset();
 }
 
 void VibrationController::PageVisibilityChanged() {
@@ -193,6 +193,7 @@ void VibrationController::PageVisibilityChanged() {
 void VibrationController::Trace(Visitor* visitor) {
   ExecutionContextLifecycleObserver::Trace(visitor);
   PageVisibilityObserver::Trace(visitor);
+  visitor->Trace(vibration_manager_);
 }
 
 }  // namespace blink

third_party/blink/renderer/modules/vibration/vibration_controller.h

@@ -21,13 +21,13 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_VIBRATION_VIBRATION_CONTROLLER_H_
 
 #include "base/macros.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/mojom/vibration_manager.mojom-blink.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/page/page_visibility_observer.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
 #include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
 #include "third_party/blink/renderer/platform/timer.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
@@ -76,7 +76,7 @@ class MODULES_EXPORT VibrationController final
 
   // Remote to VibrationManager mojo interface. This is reset in
   // |contextDestroyed| and must not be called or recreated after it is reset.
-  mojo::Remote<device::mojom::blink::VibrationManager> vibration_manager_;
+  HeapMojoRemote<device::mojom::blink::VibrationManager> vibration_manager_;
 
   // Timer for calling |doVibrate| after a delay. It is safe to call
   // |startOneshot| when the timer is already running: it may affect the time