Migrate PictureInPictureControllerImpl to use GC mojo wrappers.

No behavior change. This CL reduces potential risks of use-after-free bugs.

Bug: 1049056
Change-Id: If002f424b8883857bd0fb3664995b0ca0b10b00d
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2136988Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Kouhei Ueno <kouhei@chromium.org>
Commit-Queue: Minoru Chikamune <chikamune@chromium.org>
Cr-Commit-Position: refs/heads/master@{#758482}

third_party/blink/renderer/modules/picture_in_picture/picture_in_picture_controller_impl.cc

@@ -203,9 +203,10 @@ void PictureInPictureControllerImpl::OnEnteredPictureInPicture(
     return;
   }
 
-  picture_in_picture_session_ =
-      mojo::Remote<mojom::blink::PictureInPictureSession>(
-          std::move(session_remote));
+  picture_in_picture_session_.reset();
+  picture_in_picture_session_.Bind(
+      std::move(session_remote),
+      element->GetDocument().GetTaskRunner(TaskType::kMediaElementEvent));
 
   if (IsElementAllowed(*element, /*report_failure=*/true) != Status::kEnabled) {
     if (resolver) {
@@ -379,11 +380,6 @@ void PictureInPictureControllerImpl::PageVisibilityChanged() {
   }
 }
 
-void PictureInPictureControllerImpl::ContextDestroyed() {
-  picture_in_picture_service_.reset();
-  session_observer_receiver_.reset();
-}
-
 void PictureInPictureControllerImpl::OnPictureInPictureStateChange() {
   DCHECK(picture_in_picture_element_);
   DCHECK(picture_in_picture_element_->GetWebMediaPlayer());
@@ -409,20 +405,25 @@ void PictureInPictureControllerImpl::Trace(Visitor* visitor) {
   visitor->Trace(picture_in_picture_element_);
   visitor->Trace(auto_picture_in_picture_elements_);
   visitor->Trace(picture_in_picture_window_);
+  visitor->Trace(session_observer_receiver_);
+  visitor->Trace(picture_in_picture_service_);
+  visitor->Trace(picture_in_picture_session_);
   PictureInPictureController::Trace(visitor);
   PageVisibilityObserver::Trace(visitor);
-  ExecutionContextLifecycleObserver::Trace(visitor);
+  ExecutionContextClient::Trace(visitor);
 }
 
 PictureInPictureControllerImpl::PictureInPictureControllerImpl(
     Document& document)
     : PictureInPictureController(document),
       PageVisibilityObserver(document.GetPage()),
-      ExecutionContextLifecycleObserver(&document),
-      session_observer_receiver_(this) {}
+      ExecutionContextClient(document.ToExecutionContext()),
+      session_observer_receiver_(this, document.ToExecutionContext()),
+      picture_in_picture_service_(document.ToExecutionContext()),
+      picture_in_picture_session_(document.ToExecutionContext()) {}
 
 bool PictureInPictureControllerImpl::EnsureService() {
-  if (picture_in_picture_service_)
+  if (picture_in_picture_service_.is_bound())
     return true;
 
   if (!GetSupplementable()->GetFrame())

third_party/blink/renderer/modules/picture_in_picture/picture_in_picture_controller_impl.h

@@ -7,13 +7,13 @@
 
 #include "base/macros.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/picture_in_picture/picture_in_picture.mojom-blink.h"
 #include "third_party/blink/renderer/core/execution_context/execution_context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/frame/picture_in_picture_controller.h"
 #include "third_party/blink/renderer/core/page/page_visibility_observer.h"
 #include "third_party/blink/renderer/modules/modules_export.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_receiver.h"
+#include "third_party/blink/renderer/platform/mojo/heap_mojo_remote.h"
 
 namespace blink {
 
@@ -33,7 +33,7 @@ class TreeScope;
 class MODULES_EXPORT PictureInPictureControllerImpl
     : public PictureInPictureController,
       public PageVisibilityObserver,
-      public ExecutionContextLifecycleObserver,
+      public ExecutionContextClient,
       public blink::mojom::blink::PictureInPictureSessionObserver {
   USING_GARBAGE_COLLECTED_MIXIN(PictureInPictureControllerImpl);
 
@@ -90,9 +90,6 @@ class MODULES_EXPORT PictureInPictureControllerImpl
   // Implementation of PageVisibilityObserver.
   void PageVisibilityChanged() override;
 
-  // Implementation of ExecutionContextLifecycleObserver.
-  void ContextDestroyed() override;
-
   void Trace(Visitor*) override;
 
   bool IsSessionObserverReceiverBoundForTesting() {
@@ -123,15 +120,17 @@ class MODULES_EXPORT PictureInPictureControllerImpl
   Member<PictureInPictureWindow> picture_in_picture_window_;
 
   // Mojo bindings for the session observer interface implemented by |this|.
-  mojo::Receiver<mojom::blink::PictureInPictureSessionObserver>
+  HeapMojoReceiver<mojom::blink::PictureInPictureSessionObserver,
+                   PictureInPictureControllerImpl>
       session_observer_receiver_;
 
   // Picture-in-Picture service living in the browser process.
-  mojo::Remote<mojom::blink::PictureInPictureService>
+  HeapMojoRemote<mojom::blink::PictureInPictureService>
       picture_in_picture_service_;
 
   // Instance of the Picture-in-Picture session sent back by the service.
-  mojo::Remote<mojom::blink::PictureInPictureSession>
+  HeapMojoRemote<mojom::blink::PictureInPictureSession,
+                 HeapMojoWrapperMode::kWithoutContextObserver>
       picture_in_picture_session_;
 
   DISALLOW_COPY_AND_ASSIGN(PictureInPictureControllerImpl);