Prerender: Equip BrowserInterfaceBroker with MojoBinderPolicyApplier

Some new features, such as prerendering, need to defer some binding
interface requests or stop the renderer when an unexpected mojo pipe is
requested to set up.
This CL introduces MojoBinderPolicyApplier that manages binding requests
and integrates it with BrowserInterfaceBroker.

Regarding the MojoBinderPolicyApplier, it should be initialized with a
predefined policy map. It decide the actions the applier takes when
handling incoming requests. Based on the predefined policies and the
current state, a MojoBinderPolicyApplier instance may take the following
actions:
1. Bind the given interface immediately. (kGrant or
`ResolveDeferredBinders` has been invoked)
2. Delay binding the interface until `ResolveDeferredBinders` is called.
(kDefer)
3. Call the cancelling closure. (kCancel)
4. Stop the renderer and collect some metrics for analysis. (kUnexpected)

Bug: 1132752
Change-Id: Ifdc2f0b27d2f4613274fe5c6e44ddb056a199509
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2513960
Commit-Queue: Lingqi Chi <lingqi@chromium.org>
Reviewed-by: Matt Falkenhagen <falken@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Reviewed-by: Takashi Toyoshima <toyoshim@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#828609}

content/browser/BUILD.gn

@@ -1130,6 +1130,9 @@ source_set("browser") {
     "message_port_provider.cc",
     "mime_registry_impl.cc",
     "mime_registry_impl.h",
+    "mojo_binder_policy_applier.cc",
+    "mojo_binder_policy_applier.h",
+    "mojo_binder_policy_map.h",
     "native_io/native_io_context.cc",
     "native_io/native_io_context.h",
     "native_io/native_io_file_host.cc",

content/browser/browser_interface_broker_impl.h

@@ -6,27 +6,62 @@
 #define CONTENT_BROWSER_BROWSER_INTERFACE_BROKER_IMPL_H_
 
 #include "content/browser/browser_interface_binders.h"
+#include "content/browser/mojo_binder_policy_applier.h"
+#include "mojo/public/cpp/bindings/binder_map.h"
+#include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "third_party/blink/public/mojom/browser_interface_broker.mojom.h"
 
 namespace content {
 
 // content's implementation of the BrowserInterfaceBroker interface that binds
 // interfaces requested by the renderer. Every execution context type (frame,
-// worker etc) owns an instance and registers appropriate handlers (see
-// internal::PopulateBinderMap).
-// Note: this mechanism will eventually replace the usage of InterfaceProvider
-// and browser manifests, as well as DocumentInterfaceBroker.
+// worker etc) owns an instance and registers appropriate handlers, called
+// "binders" (see internal::PopulateBinderMap and
+// internal::PopulateBinderMapWithContext).
+//
+// By default, BrowserInterfaceBrokerImpl runs the binder that was registered
+// for a given interface when the interface is requested. However, in some cases
+// such as prerendering pages, it may be desirable to defer running the binder,
+// or take another action. BrowserInterfaceBrokerImpl can be initialized with a
+// non-null `MojoBinderPolicyApplier` to enable this behavior.
+//
+// Note: BrowserInterfaceBrokerImpl will eventually replace the usage of
+// InterfaceProvider and browser manifests, as well as DocumentInterfaceBroker.
 template <typename ExecutionContextHost, typename InterfaceBinderContext>
 class BrowserInterfaceBrokerImpl : public blink::mojom::BrowserInterfaceBroker {
  public:
-  BrowserInterfaceBrokerImpl(ExecutionContextHost* host) : host_(host) {
+  BrowserInterfaceBrokerImpl(
+      ExecutionContextHost* host,
+      std::unique_ptr<MojoBinderPolicyApplier> policy_applier)
+      : host_(host), policy_applier_(std::move(policy_applier)) {
     internal::PopulateBinderMap(host, &binder_map_);
     internal::PopulateBinderMapWithContext(host, &binder_map_with_context_);
   }
 
+  // Disallows copy and move operations.
+  BrowserInterfaceBrokerImpl(const BrowserInterfaceBrokerImpl& other) = delete;
+  BrowserInterfaceBrokerImpl& operator=(
+      const BrowserInterfaceBrokerImpl& other) = delete;
+  BrowserInterfaceBrokerImpl(BrowserInterfaceBrokerImpl&&) = delete;
+  BrowserInterfaceBrokerImpl& operator=(BrowserInterfaceBrokerImpl&&) = delete;
+
   // blink::mojom::BrowserInterfaceBroker
   void GetInterface(mojo::GenericPendingReceiver receiver) {
     DCHECK(receiver.interface_name().has_value());
+    if (!policy_applier_) {
+      BindInterface(std::move(receiver));
+    } else {
+      std::string interface_name = receiver.interface_name().value();
+      // base::Unretained is safe because `this` owns `policy_applier_`.
+      policy_applier_->ApplyPolicyToBinder(
+          interface_name,
+          base::BindOnce(&BrowserInterfaceBrokerImpl::BindInterface,
+                         base::Unretained(this), std::move(receiver)));
+    }
+  }
+
+ private:
+  void BindInterface(mojo::GenericPendingReceiver receiver) {
     if (!binder_map_.TryBind(&receiver)) {
       if (!binder_map_with_context_.TryBind(internal::GetContextForHost(host_),
                                             &receiver)) {
@@ -36,12 +71,10 @@ class BrowserInterfaceBrokerImpl : public blink::mojom::BrowserInterfaceBroker {
     }
   }
 
- private:
   ExecutionContextHost* const host_;
   mojo::BinderMap binder_map_;
   mojo::BinderMapWithContext<InterfaceBinderContext> binder_map_with_context_;
-
-  DISALLOW_COPY_AND_ASSIGN(BrowserInterfaceBrokerImpl);
+  std::unique_ptr<MojoBinderPolicyApplier> policy_applier_;
 };
 
 }  // namespace content

content/browser/mojo_binder_policy_applier.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/mojo_binder_policy_applier.h"
+
+namespace content {
+
+MojoBinderPolicyApplier::MojoBinderPolicyApplier(
+    const MojoBinderPolicyMap* policy_map,
+    base::OnceClosure cancel_closure)
+    : policy_map_(*policy_map), cancel_closure_(std::move(cancel_closure)) {}
+
+MojoBinderPolicyApplier::~MojoBinderPolicyApplier() = default;
+
+void MojoBinderPolicyApplier::ApplyPolicyToBinder(
+    const std::string& interface_name,
+    base::OnceClosure binder_callback) {
+  if (grant_all_) {
+    std::move(binder_callback).Run();
+    return;
+  }
+  const MojoBinderPolicy policy = GetMojoBinderPolicy(interface_name);
+  switch (policy) {
+    case MojoBinderPolicy::kGrant:
+      std::move(binder_callback).Run();
+      break;
+    case MojoBinderPolicy::kCancel:
+      // TODO(crbug.com/1132752): Integrate with `PrerenderHostRegistry`.
+      if (cancel_closure_)
+        std::move(cancel_closure_).Run();
+      break;
+    case MojoBinderPolicy::kDefer:
+      deferred_binders_.push_back(std::move(binder_callback));
+      break;
+    case MojoBinderPolicy::kUnexpected:
+      // TODO(crbug.com/1141364): Report a metric to understand the unexpected
+      // case.
+      break;
+  }
+}
+
+void MojoBinderPolicyApplier::GrantAll() {
+  DCHECK(!grant_all_);
+  grant_all_ = true;
+  // It's safe to iterate over `deferred_binders_` because no more callbacks
+  // will be added to it once `grant_all_` is true."
+  for (auto& deferred_binder : deferred_binders_)
+    std::move(deferred_binder).Run();
+  deferred_binders_.clear();
+}
+
+MojoBinderPolicy MojoBinderPolicyApplier::GetMojoBinderPolicy(
+    const std::string& interface_name) const {
+  MojoBinderPolicy policy = default_policy_;
+  const auto& found = policy_map_.find(interface_name);
+  if (found != policy_map_.end())
+    policy = found->second;
+  return policy;
+}
+
+}  // namespace content

content/browser/mojo_binder_policy_applier.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_MOJO_BINDER_POLICY_APPLIER_H_
+#define CONTENT_BROWSER_MOJO_BINDER_POLICY_APPLIER_H_
+
+#include <string>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "content/browser/mojo_binder_policy_map.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// MojoBinderPolicyApplier is a helper class for `BrowserInterfaceBrokerImpl`
+// which allows control over when to run the binder registered for a
+// requested interface. This is useful in cases like prerendering pages, where
+// it can be desirable to defer binding until the page is activated, or take
+// other actions.
+//
+// The action to take for each interface is specified in the given
+// `MojoBinderPolicyMap`, and kDefer is used when no policy is specified.
+//
+// See content/browser/prerender/README.md for more about capability control.
+class CONTENT_EXPORT MojoBinderPolicyApplier {
+ public:
+  // `policy_map` must outlive `this` and must not be null.
+  // `cancel_closure` will be executed when ApplyPolicyToBinder() processes a
+  // kCancel interface.
+  MojoBinderPolicyApplier(const MojoBinderPolicyMap* policy_map,
+                          base::OnceClosure cancel_closure);
+  ~MojoBinderPolicyApplier();
+
+  // Disallows copy and move operations.
+  MojoBinderPolicyApplier(const MojoBinderPolicyApplier& other) = delete;
+  MojoBinderPolicyApplier& operator=(const MojoBinderPolicyApplier& other) =
+      delete;
+  MojoBinderPolicyApplier(MojoBinderPolicyApplier&&) = delete;
+  MojoBinderPolicyApplier& operator=(MojoBinderPolicyApplier&&) = delete;
+
+  // Applies `MojoBinderPolicy` before binding an interface.
+  // - kGrant: Runs `binder_callback` immediately.
+  // - kDefer: Saves `binder_callback` and runs it when GrantAll() is called.
+  // - kCancel: Drops `binder_callback` and runs `cancel_closure_`.
+  // - kUnexpected: Unimplemented now.
+  // If GrantAll() was already called, this always runs the callback
+  // immediately.
+  void ApplyPolicyToBinder(const std::string& interface_name,
+                           base::OnceClosure binder_callback);
+  // Runs all deferred binders and runs binder callbacks for all subsequent
+  // requests, i.e., it stops applying the policies.
+  void GrantAll();
+
+ private:
+  // Gets the corresponding policy of the given mojo interface name.
+  MojoBinderPolicy GetMojoBinderPolicy(const std::string& interface_name) const;
+
+  const MojoBinderPolicy default_policy_ = MojoBinderPolicy::kDefer;
+  // Maps Mojo interface name to its policy.
+  const MojoBinderPolicyMap& policy_map_;
+  // Will be executed upon a request for a kCancel interface.
+  base::OnceClosure cancel_closure_;
+  // Indicates if MojoBinderPolicyApplier grants all binding requests regardless
+  // of their policies.
+  bool grant_all_ = false;
+  // Stores binders which are delayed running.
+  std::vector<base::OnceClosure> deferred_binders_;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_MOJO_BINDER_POLICY_APPLIER_H_

content/browser/mojo_binder_policy_applier_unittest.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/mojo_binder_policy_applier.h"
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/memory/weak_ptr.h"
+#include "base/test/task_environment.h"
+#include "content/browser/mojo_binder_policy_map.h"
+#include "content/test/test_mojo_binder_policy_applier_unittest.mojom.h"
+#include "mojo/public/cpp/bindings/generic_pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+// A test class that implements test interfaces and provides verification
+// methods.
+class TestReceiverCollector : public mojom::TestInterfaceForDefer,
+                              public mojom::TestInterfaceForGrant,
+                              public mojom::TestInterfaceForCancel {
+ public:
+  TestReceiverCollector() = default;
+
+  ~TestReceiverCollector() override = default;
+
+  // Deletes copy and move operations.
+  TestReceiverCollector(const TestReceiverCollector& other) = delete;
+  TestReceiverCollector& operator=(const TestReceiverCollector& other) = delete;
+  TestReceiverCollector(TestReceiverCollector&&) = delete;
+  TestReceiverCollector& operator=(TestReceiverCollector&&) = delete;
+
+  void BindDeferInterface(
+      mojo::PendingReceiver<mojom::TestInterfaceForDefer> receiver) {
+    ASSERT_FALSE(defer_receiver_.is_bound());
+    defer_receiver_.Bind(std::move(receiver));
+  }
+
+  void BindGrantInterface(
+      mojo::PendingReceiver<mojom::TestInterfaceForGrant> receiver) {
+    ASSERT_FALSE(grant_receiver_.is_bound());
+    grant_receiver_.Bind(std::move(receiver));
+  }
+
+  void BindCancelInterface(
+      mojo::PendingReceiver<mojom::TestInterfaceForCancel> receiver) {
+    ASSERT_FALSE(cancel_receiver_.is_bound());
+    cancel_receiver_.Bind(std::move(receiver));
+  }
+
+  // Will be called when MojoBinderPolicyApplier::ApplyPolicyToBinder()
+  // handles a kCancel binding request.
+  void Cancel() { is_canceled_ = true; }
+
+  // Used to check if the cancel_closure of MojoBinderPolicyApplier was
+  // executed.
+  bool IsCanceled() { return is_canceled_; }
+
+  bool IsDeferReceiverBound() const { return defer_receiver_.is_bound(); }
+
+  bool IsGrantReceiverBound() const { return grant_receiver_.is_bound(); }
+
+  bool IsCancelReceiverBound() const { return cancel_receiver_.is_bound(); }
+
+ private:
+  mojo::Receiver<mojom::TestInterfaceForDefer> defer_receiver_{this};
+  mojo::Receiver<mojom::TestInterfaceForGrant> grant_receiver_{this};
+  mojo::Receiver<mojom::TestInterfaceForCancel> cancel_receiver_{this};
+  bool is_canceled_ = false;
+};
+
+class MojoBinderPolicyApplierTest : public testing::Test {
+ public:
+  MojoBinderPolicyApplierTest() = default;
+
+ protected:
+  const MojoBinderPolicyMap policy_map_{
+      {{"content.mojom.TestInterfaceForDefer", MojoBinderPolicy::kDefer},
+       {"content.mojom.TestInterfaceForGrant", MojoBinderPolicy::kGrant},
+       {"content.mojom.TestInterfaceForCancel", MojoBinderPolicy::kCancel}}};
+  TestReceiverCollector collector_{};
+  MojoBinderPolicyApplier policy_applier_{
+      &policy_map_, base::BindOnce(&TestReceiverCollector::Cancel,
+                                   base::Unretained(&collector_))};
+
+ private:
+  base::test::TaskEnvironment task_environment_;
+};
+
+// Verifies that interfaces whose policies are kDefer cannot be bound until
+// GrantAll() is called.
+TEST_F(MojoBinderPolicyApplierTest, ApplyDeferPolicy) {
+  // Initialize Mojo interfaces.
+  mojo::Remote<mojom::TestInterfaceForDefer> defer_remote;
+  mojo::GenericPendingReceiver defer_receiver(
+      defer_remote.BindNewPipeAndPassReceiver());
+
+  // Delay binding the interface until GrantAll() is called.
+  const std::string interface_name = defer_receiver.interface_name().value();
+  EXPECT_FALSE(collector_.IsCanceled());
+  policy_applier_.ApplyPolicyToBinder(
+      interface_name,
+      base::BindOnce(&TestReceiverCollector::BindDeferInterface,
+                     base::Unretained(&collector_),
+                     defer_receiver.As<mojom::TestInterfaceForDefer>()));
+  EXPECT_FALSE(collector_.IsDeferReceiverBound());
+  policy_applier_.GrantAll();
+  EXPECT_TRUE(collector_.IsDeferReceiverBound());
+  EXPECT_FALSE(collector_.IsCanceled());
+}
+
+// Verifies that interfaces whose policies are kGrant can be bound immediately.
+TEST_F(MojoBinderPolicyApplierTest, ApplyGrantPolicy) {
+  // Initialize Mojo interfaces.
+  mojo::Remote<mojom::TestInterfaceForGrant> grant_remote;
+  mojo::GenericPendingReceiver grant_receiver(
+      grant_remote.BindNewPipeAndPassReceiver());
+
+  // Bind the interface immediately if the policy is kGrant.
+  const std::string interface_name = grant_receiver.interface_name().value();
+  EXPECT_FALSE(collector_.IsCanceled());
+  EXPECT_FALSE(collector_.IsGrantReceiverBound());
+  policy_applier_.ApplyPolicyToBinder(
+      interface_name,
+      base::BindOnce(&TestReceiverCollector::BindGrantInterface,
+                     base::Unretained(&collector_),
+                     grant_receiver.As<mojom::TestInterfaceForGrant>()));
+  EXPECT_TRUE(collector_.IsGrantReceiverBound());
+  EXPECT_FALSE(collector_.IsCanceled());
+}
+
+// Verifies that when receiving an interface whose policy is kCancel,
+// cancel_closure_ can be invoked.
+TEST_F(MojoBinderPolicyApplierTest, ApplyCancelPolicy) {
+  // Initialize Mojo interfaces.
+  mojo::Remote<mojom::TestInterfaceForCancel> cancel_remote;
+  mojo::GenericPendingReceiver cancel_receiver(
+      cancel_remote.BindNewPipeAndPassReceiver());
+
+  const std::string interface_name = cancel_receiver.interface_name().value();
+  EXPECT_FALSE(collector_.IsCanceled());
+  EXPECT_FALSE(collector_.IsCancelReceiverBound());
+  policy_applier_.ApplyPolicyToBinder(
+      interface_name,
+      base::BindOnce(&TestReceiverCollector::BindCancelInterface,
+                     base::Unretained(&collector_),
+                     cancel_receiver.As<mojom::TestInterfaceForCancel>()));
+  EXPECT_TRUE(collector_.IsCanceled());
+  EXPECT_FALSE(collector_.IsCancelReceiverBound());
+}
+
+// Verifies that all interfaces are bound immediately if GrantAll() is called,
+// regardless of policies.
+TEST_F(MojoBinderPolicyApplierTest, BindInterfacesAfterResolving) {
+  // Initialize Mojo interfaces.
+  mojo::Remote<mojom::TestInterfaceForDefer> defer_remote;
+  mojo::GenericPendingReceiver defer_receiver(
+      defer_remote.BindNewPipeAndPassReceiver());
+  mojo::Remote<mojom::TestInterfaceForGrant> grant_remote;
+  mojo::GenericPendingReceiver grant_receiver(
+      grant_remote.BindNewPipeAndPassReceiver());
+  mojo::Remote<mojom::TestInterfaceForCancel> cancel_remote;
+  mojo::GenericPendingReceiver cancel_receiver(
+      cancel_remote.BindNewPipeAndPassReceiver());
+
+  policy_applier_.GrantAll();
+  // All interfaces should be bound immediately.
+  const std::string defer_interface_name =
+      defer_receiver.interface_name().value();
+  const std::string grant_interface_name =
+      grant_receiver.interface_name().value();
+  const std::string cancel_interface_name =
+      cancel_receiver.interface_name().value();
+  EXPECT_FALSE(collector_.IsCanceled());
+  EXPECT_FALSE(collector_.IsGrantReceiverBound());
+  EXPECT_FALSE(collector_.IsDeferReceiverBound());
+  EXPECT_FALSE(collector_.IsCancelReceiverBound());
+  policy_applier_.ApplyPolicyToBinder(
+      defer_interface_name,
+      base::BindOnce(&TestReceiverCollector::BindDeferInterface,
+                     base::Unretained(&collector_),
+                     defer_receiver.As<mojom::TestInterfaceForDefer>()));
+  policy_applier_.ApplyPolicyToBinder(
+      grant_interface_name,
+      base::BindOnce(&TestReceiverCollector::BindGrantInterface,
+                     base::Unretained(&collector_),
+                     grant_receiver.As<mojom::TestInterfaceForGrant>()));
+  policy_applier_.ApplyPolicyToBinder(
+      cancel_interface_name,
+      base::BindOnce(&TestReceiverCollector::BindCancelInterface,
+                     base::Unretained(&collector_),
+                     cancel_receiver.As<mojom::TestInterfaceForCancel>()));
+  EXPECT_TRUE(collector_.IsGrantReceiverBound());
+  EXPECT_TRUE(collector_.IsDeferReceiverBound());
+  EXPECT_TRUE(collector_.IsCancelReceiverBound());
+  EXPECT_FALSE(collector_.IsCanceled());
+}
+
+}  // namespace
+
+}  // namespace content

content/browser/mojo_binder_policy_map.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_MOJO_BINDER_POLICY_MAP_H_
+#define CONTENT_BROWSER_MOJO_BINDER_POLICY_MAP_H_
+
+#include "base/containers/flat_map.h"
+
+namespace content {
+
+// MojoBinderPolicy specifies policies used by `MojoBinderPolicyMapApplier` for
+// mojo capability control.
+// See the comment in `MojoBinderPolicyApplier::ApplyPolicyToBinder()` for
+// details.
+enum class MojoBinderPolicy {
+  // Run the binder registered for the requested interface as normal.
+  kGrant,
+  // Defer running the binder registered for the requested interface. Deferred
+  // binders can be explicitly asked to run later.
+  kDefer,
+  // Used for interface requests that cannot be handled and should cause the
+  // requesting context to be discarded (for example, cancel prerendering).
+  kCancel,
+  // The interface request is not expected. Kill the calling renderer.
+  kUnexpected,
+};
+
+// Maps Mojo interface name to policy.
+using MojoBinderPolicyMap = base::flat_map<std::string, MojoBinderPolicy>;
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_MOJO_BINDER_POLICY_MAP_H_

content/browser/prerender/README.md

@@ -31,4 +31,4 @@ The Prerender2 is the new implementation of prerendering.
 
 The date is the publication date, not the last updated date.
 
-- [Prerender2](https://docs.google.com/document/d/1P2VKCLpmnNm_cRAjUeE-bqLL0bslL_zKqiNeCzNom_w/edit?usp=sharing) (Oct, 2020)
+- [Prerender2](https://docs.google.com/document/d/1P2VKCLpmnNm_cRAjUeE-bqLL0bslL_zKqiNeCzNom_w/edit?usp=sharing) (Oct, 2020): Introduces how Prerender2 works and more detailed designs such as Mojo Capability Control.

content/browser/renderer_host/render_frame_host_impl.h

@@ -3002,8 +3002,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // BrowserInterfaceBroker implementation through which this
   // RenderFrameHostImpl exposes document-scoped Mojo services to the currently
   // active document in the corresponding RenderFrame.
+  // TODO(crbug.com/1132752): Enable capability control for Prerender2 by
+  // initializing BrowserInterfaceBrokerImpl with a non-null
+  // MojoBinderPolicyApplier pointer.
   BrowserInterfaceBrokerImpl<RenderFrameHostImpl, RenderFrameHost*> broker_{
-      this};
+      this, /*policy_applier=*/nullptr};
   mojo::Receiver<blink::mojom::BrowserInterfaceBroker> broker_receiver_{
       &broker_};
 

content/browser/service_worker/service_worker_host.h

@@ -84,7 +84,7 @@ class CONTENT_EXPORT ServiceWorkerHost {
   ServiceWorkerVersion* const version_;
 
   BrowserInterfaceBrokerImpl<ServiceWorkerHost, const ServiceWorkerVersionInfo&>
-      broker_{this};
+      broker_{this, /*policy_applier=*/nullptr};
   mojo::Receiver<blink::mojom::BrowserInterfaceBroker> broker_receiver_{
       &broker_};
 

content/browser/worker_host/dedicated_worker_host.h

@@ -200,7 +200,7 @@ class DedicatedWorkerHost final : public RenderProcessHostObserver {
   std::unique_ptr<ServiceWorkerMainResourceHandle> service_worker_handle_;
 
   BrowserInterfaceBrokerImpl<DedicatedWorkerHost, const url::Origin&> broker_{
-      this};
+      this, /*policy_applier=*/nullptr};
   mojo::Receiver<blink::mojom::BrowserInterfaceBroker> broker_receiver_{
       &broker_};
 

content/browser/worker_host/shared_worker_host.h

@@ -245,7 +245,7 @@ class CONTENT_EXPORT SharedWorkerHost : public blink::mojom::SharedWorkerHost,
   mojo::Remote<blink::mojom::SharedWorkerFactory> factory_;
 
   BrowserInterfaceBrokerImpl<SharedWorkerHost, const url::Origin&> broker_{
-      this};
+      this, /*policy_applier=*/nullptr};
   mojo::Receiver<blink::mojom::BrowserInterfaceBroker> broker_receiver_{
       &broker_};
 

content/test/BUILD.gn

@@ -789,6 +789,7 @@ mojom("content_test_mojo_bindings") {
     "../public/test/test_service.mojom",
     "frame_host_test_interface.mojom",
     "test_browser_associated_interfaces.mojom",
+    "test_mojo_binder_policy_applier_unittest.mojom",
   ]
   public_deps = [
     "//mojo/public/mojom/base",
@@ -1866,6 +1867,7 @@ test("content_unittests") {
     "../browser/media/system_media_controls_notifier_unittest.cc",
     "../browser/media/webaudio/audio_context_manager_impl_unittest.cc",
     "../browser/memory/swap_metrics_driver_impl_unittest.cc",
+    "../browser/mojo_binder_policy_applier_unittest.cc",
     "../browser/native_io/native_io_context_unittest.cc",
     "../browser/net/cross_origin_embedder_policy_reporter_unittest.cc",
     "../browser/net/cross_origin_opener_policy_reporter_unittest.cc",

content/test/test_mojo_binder_policy_applier_unittest.mojom

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+// The interface is used in mojo_binder_policy_applier_unittest.cc, the
+// MojoBinderPolicy of this interface is kDefer.
+interface TestInterfaceForDefer {};
+
+// The interface is used in mojo_binder_policy_applier_unittest.cc, the
+// MojoBinderPolicy of this interface is kGrant.
+interface TestInterfaceForGrant {};
+
+// The interface is used in mojo_binder_policy_applier_unittest.cc, the
+// MojoBinderPolicy of this interface is kCancel.
+interface TestInterfaceForCancel {};