Make TabCapture requests use the target render process and render view id's for UI permissions.

content/browser/renderer_host/media/media_stream_manager.cc

Index: content/browser/renderer_host/media/media_stream_manager.cc
diff --git a/content/browser/renderer_host/media/media_stream_manager.cc b/content/browser/renderer_host/media/media_stream_manager.cc
index 864e999d0b32e429081450bfa194e1ad953f465b..1421e7472af2c1435df04df69f8ddf20cb724fdd 100644
--- a/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/content/browser/renderer_host/media/media_stream_manager.cc
@@ -248,11 +248,20 @@ std::string MediaStreamManager::GenerateStreamForDevice(
     const GURL& security_origin) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 
+  int target_render_process_id = -1;
+  int target_render_view_id = -1;
+  // We will post the request to the target render view, not the source (i.e.
+  // source is an extension, and target is the tab we want to capture).
+  CHECK(WebContentsCaptureUtil::ExtractTabCaptureTarget(

[no longer working on chromium, 2012/12/07 14:13:10]

what will trigger this GenerateStreamForDevice?
If this can be triggered by JS, you should not add CHECK here, since the hackers
can easily crash the chrome.

[justinlin, 2012/12/07 15:50:09]

Done. Good point. Fixed and tested this possible issue.

+            device_id, &target_render_process_id, &target_render_view_id));
+  DCHECK_NE(target_render_process_id, -1);
+  DCHECK_NE(target_render_view_id, -1);
+
   // Create a new request based on options.
   DeviceRequest* request = new DeviceRequest(requester, options,
                                              DeviceRequest::GENERATE_STREAM,
-                                             render_process_id,
-                                             render_view_id,
+                                             target_render_process_id,
+                                             target_render_view_id,
                                              security_origin);
   const std::string& label = AddRequest(request);
   request->requested_device_id = device_id;
@@ -859,6 +868,12 @@ void MediaStreamManager::DevicesAccepted(const std::string& label,
        device_it != devices.end(); ++device_it) {
     StreamDeviceInfo device_info = *device_it;  // Make a copy.
 
+    // TODO(justinlin): Nicer way to do this?
+    // Re-append the device_id since we lost it when posting request to UI.
+    if (device_info.stream_type == content::MEDIA_TAB_VIDEO_CAPTURE ||
+        device_info.stream_type == content::MEDIA_TAB_AUDIO_CAPTURE)
+      device_info.device_id = request->requested_device_id;

[no longer working on chromium, 2012/12/07 14:13:10]

curiously, what is this device_id? is the process_id + view_id? or is it a real
device?

[justinlin, 2012/12/07 15:50:09]

It's 'process_id + view_id'. We need to pass it to the WebContentsVideoDevice
and eventually to the VirtualAudio streams too (right now for audio, we just use
whole browser audio, so it's not used) to know which tab to capture.

+
     // Set in_use to false to be able to track if this device has been
     // opened. in_use might be true if the device type can be used in more
     // than one session.
@@ -937,22 +952,8 @@ void MediaStreamManager::NotifyDevicesOpened(const DeviceRequest& request) {
   if (opened_devices.empty())
     return;
 
-  int target_render_process_id = request.render_process_id;
-  int target_render_view_id = request.render_view_id;
-
-  // For tab capture requests, we should notify the UI to update the renderer
-  // that is the target of the capture instead of the requester.
-  if (request.options.audio_type == content::MEDIA_TAB_AUDIO_CAPTURE ||
-      request.options.video_type == content::MEDIA_TAB_VIDEO_CAPTURE) {
-    if (!WebContentsCaptureUtil::ExtractTabCaptureTarget(
-            request.requested_device_id,
-            &target_render_process_id,
-            &target_render_view_id))
-      return;
-  }
-
-  NotifyUIDevicesOpened(target_render_process_id,
-                        target_render_view_id,
+  NotifyUIDevicesOpened(request.render_process_id,
+                        request.render_view_id,
                         opened_devices);
 }
 
@@ -963,22 +964,8 @@ void MediaStreamManager::NotifyDevicesClosed(const DeviceRequest& request) {
   if (closed_devices.empty())
     return;
 
-  int target_render_process_id = request.render_process_id;
-  int target_render_view_id = request.render_view_id;
-
-  // For tab capture requests, we should notify the UI to update the renderer
-  // that is the target of the capture instead of the requester.
-  if (request.options.audio_type == content::MEDIA_TAB_AUDIO_CAPTURE ||
-      request.options.video_type == content::MEDIA_TAB_VIDEO_CAPTURE) {
-    if (!WebContentsCaptureUtil::ExtractTabCaptureTarget(
-            request.requested_device_id,
-            &target_render_process_id,
-            &target_render_view_id))
-      return;
-  }
-
-  NotifyUIDevicesClosed(target_render_process_id,
-                        target_render_view_id,
+  NotifyUIDevicesClosed(request.render_process_id,
+                        request.render_view_id,
                         closed_devices);
 }