Fix crash on startup when WebUI tab strip is enabled

While migrating viz::mojom::FrameSinkVideoConsumerFrameCallbacks
to the new Mojo types[1], we migrated the InterfacePtr inside the
FramePinner struct passed as context SkBitmap::installPixels() as
|context| to a mojo::Remote, causing a crash when such struct gets
released since that will happen in a different thread than the one
the mojo::Remote was originally bound from.

Since the purpose of this struct is just to keep some shared memory
from being released before the pixels passed to SkBitmap::installPixels
stop being referenced (and not to use the mojo::Remote<> in any other
way), we can instead make FramePinner::releaser a mojo::PendingRemote<>
and just pass the result of calling |callback_remote.Unbind()| when
constructing the FramePinner struct, ensuring that the remote gets
unbound in the right thread.

[1] https://crrev.com/c/1860534

Bug: 955171, 978694, 1016005
Change-Id: I3df1f8e983fe8d8ead17cf627e0e69847a2e6b3c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1871514Reviewed-by: Dana Fried <dfried@chromium.org>
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Oksana Zhuravlova <oksamyt@chromium.org>
Commit-Queue: Mario Sanchez Prada <mario@igalia.com>
Cr-Commit-Position: refs/heads/master@{#708114}

chrome/browser/devtools/devtools_eye_dropper.cc

@@ -310,7 +310,8 @@ void DevToolsEyeDropper::OnFrameCaptured(
     base::ReadOnlySharedMemoryMapping mapping;
     // Prevents FrameSinkVideoCapturer from recycling the shared memory that
     // backs |frame_|.
-    mojo::Remote<viz::mojom::FrameSinkVideoConsumerFrameCallbacks> releaser;
+    mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumerFrameCallbacks>
+        releaser;
   };
   frame_.installPixels(
       SkImageInfo::MakeN32(content_rect.width(), content_rect.height(),
@@ -322,7 +323,7 @@ void DevToolsEyeDropper::OnFrameCaptured(
       [](void* addr, void* context) {
         delete static_cast<FramePinner*>(context);
       },
-      new FramePinner{std::move(mapping), std::move(callbacks_remote)});
+      new FramePinner{std::move(mapping), callbacks_remote.Unbind()});
   frame_.setImmutable();
 
   UpdateCursor();

chrome/browser/ui/thumbnails/thumbnail_tab_helper.cc

@@ -254,7 +254,8 @@ void ThumbnailTabHelper::OnFrameCaptured(
     base::ReadOnlySharedMemoryMapping mapping;
     // Prevents FrameSinkVideoCapturer from recycling the shared memory that
     // backs |frame_|.
-    mojo::Remote<viz::mojom::FrameSinkVideoConsumerFrameCallbacks> releaser;
+    mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumerFrameCallbacks>
+        releaser;
   };
 
   content::RenderWidgetHostView* const source_view = GetView();
@@ -289,7 +290,7 @@ void ThumbnailTabHelper::OnFrameCaptured(
       [](void* addr, void* context) {
         delete static_cast<FramePinner*>(context);
       },
-      new FramePinner{std::move(mapping), std::move(callbacks_remote)});
+      new FramePinner{std::move(mapping), callbacks_remote.Unbind()});
   frame.setImmutable();
 
   SkBitmap cropped_frame;