bluetooth: Move writeValue to mojo

content/browser/bluetooth/web_bluetooth_service_impl.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/bluetooth/web_bluetooth_service_impl.h"
+
+#include "content/browser/bluetooth/bluetooth_blacklist.h"
+#include "content/browser/bluetooth/bluetooth_dispatcher_host.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
+#include "content/public/browser/render_frame_host.h"
+#include "device/bluetooth/bluetooth_gatt_characteristic.h"
+
+using device::BluetoothGattService;
+
+namespace content {
+
+namespace {
+
+blink::mojom::WebBluetoothError GetWebError(CacheQueryOutcome outcome) {
+  switch (outcome) {
+    case CacheQueryOutcome::BAD_RENDERER:
+      NOTREACHED();
+      return blink::mojom::WebBluetoothError::DEVICE_NO_LONGER_IN_RANGE;
+    case CacheQueryOutcome::SUCCESS:
+      return blink::mojom::WebBluetoothError::SUCCESS;
+    case CacheQueryOutcome::NO_DEVICE:
+      return blink::mojom::WebBluetoothError::DEVICE_NO_LONGER_IN_RANGE;
+    case CacheQueryOutcome::NO_SERVICE:
+      return blink::mojom::WebBluetoothError::SERVICE_NO_LONGER_EXISTS;
+    case CacheQueryOutcome::NO_CHARACTERISTIC:
+      return blink::mojom::WebBluetoothError::CHARACTERISTIC_NO_LONGER_EXISTS;
+  }
+  NOTREACHED();
+  return blink::mojom::WebBluetoothError::DEVICE_NO_LONGER_IN_RANGE;
+}
+
+blink::mojom::WebBluetoothError TranslateGATTErrorAndRecord(
+    BluetoothGattService::GattErrorCode error_code,
+    UMAGATTOperation operation) {
+  switch (error_code) {
+    case BluetoothGattService::GATT_ERROR_UNKNOWN:
+      RecordGATTOperationOutcome(operation, UMAGATTOperationOutcome::UNKNOWN);
+      return blink::mojom::WebBluetoothError::GATT_UNKNOWN_ERROR;
+    case BluetoothGattService::GATT_ERROR_FAILED:
+      RecordGATTOperationOutcome(operation, UMAGATTOperationOutcome::FAILED);
+      return blink::mojom::WebBluetoothError::GATT_UNKNOWN_FAILURE;
+    case BluetoothGattService::GATT_ERROR_IN_PROGRESS:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::IN_PROGRESS);
+      return blink::mojom::WebBluetoothError::GATT_OPERATION_IN_PROGRESS;
+    case BluetoothGattService::GATT_ERROR_INVALID_LENGTH:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::INVALID_LENGTH);
+      return blink::mojom::WebBluetoothError::GATT_INVALID_ATTRIBUTE_LENGTH;
+    case BluetoothGattService::GATT_ERROR_NOT_PERMITTED:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::NOT_PERMITTED);
+      return blink::mojom::WebBluetoothError::GATT_NOT_PERMITTED;
+    case BluetoothGattService::GATT_ERROR_NOT_AUTHORIZED:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::NOT_AUTHORIZED);
+      return blink::mojom::WebBluetoothError::GATT_NOT_AUTHORIZED;
+    case BluetoothGattService::GATT_ERROR_NOT_PAIRED:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::NOT_PAIRED);
+      return blink::mojom::WebBluetoothError::GATT_NOT_PAIRED;
+    case BluetoothGattService::GATT_ERROR_NOT_SUPPORTED:
+      RecordGATTOperationOutcome(operation,
+                                 UMAGATTOperationOutcome::NOT_SUPPORTED);
+      return blink::mojom::WebBluetoothError::GATT_NOT_SUPPORTED;
+  }
+  NOTREACHED();
+  return blink::mojom::WebBluetoothError::GATT_UNTRANSLATED_ERROR_CODE;
+}
+
+}  // namespace
+
+using CacheQueryResult = BluetoothDispatcherHost::CacheQueryResult;
+
+WebBluetoothServiceImpl::WebBluetoothServiceImpl(
+    RenderFrameHost* render_frame_host,
+    mojo::InterfaceRequest<blink::mojom::WebBluetoothService> request)
+    : render_frame_host_(render_frame_host),
+      render_process_host_(render_frame_host->GetProcess()),
+      binding_(this, std::move(request)),
+      weak_ptr_factory_(this) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  // Bind all future weak pointers to the UI thread.
+  weak_ptr_on_ui_thread_ = weak_ptr_factory_.GetWeakPtr();

[Ken Rockot(use gerrit already), 2016/03/17 18:16:13]

nit: I think this is a weird thing to do, but it seems like this mechanism is
already being used elsewhere in bluetooth code. If the impl is the only thing
vending WeakPtrs, and the impl always checks that it's being called on the right
thread, this doesn't add any real value as far as I can tell. It's possible that
someone might run a weakptr-bound callback on the wrong thread, but the
DCHECK_CURRENTLY_ONs will catch that.

[ortuno, 2016/03/18 01:19:20]

I agree. I'll bring it up with scheib. 

+  weak_ptr_on_ui_thread_.get();  // Associates with UI thread.
+}
+
+WebBluetoothServiceImpl::~WebBluetoothServiceImpl() {}
+
+void WebBluetoothServiceImpl::RemoteCharacteristicWriteValue(
+    const mojo::String& characteristic_instance_id,
+    mojo::Array<uint8_t> value,
+    const RemoteCharacteristicWriteValueCallback& callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RecordWebBluetoothFunctionCall(
+      UMAWebBluetoothFunction::CHARACTERISTIC_WRITE_VALUE);
+
+  RecordWebBluetoothFunctionCall(
+      UMAWebBluetoothFunction::CHARACTERISTIC_WRITE_VALUE);
+
+  // We perform the length check on the renderer side. So if we
+  // get a value with length > 512, we can assume it's a hostile
+  // renderer and kill it.
+  if (value.size() > 512) {
+    CrashRenderer(bad_message::BDH_INVALID_WRITE_VALUE_LENGTH);
+    return;

[Ken Rockot(use gerrit already), 2016/03/17 18:16:13]

You should still invoke the callback here. At least for now its internal state
will DCHECK if it's destroyed while the pipe is still open and the callback
hasn't been invoked. The pipe may still appear to be open briefly after the
renderer crashes.

[ortuno, 2016/03/18 01:19:20]

I call binding_.Close() on CrashRenderAndClosePipe now.

+  }
+
+  CacheQueryResult query_result =
+      GetBluetoothDispatcherHost()->QueryCacheForCharacteristic(
+          GetOrigin(), characteristic_instance_id);
+
+  if (query_result.outcome == CacheQueryOutcome::BAD_RENDERER) {
+    return;
+  }
+
+  if (query_result.outcome != CacheQueryOutcome::SUCCESS) {
+    RecordCharacteristicWriteValueOutcome(query_result.outcome);
+    callback.Run(GetWebError(query_result.outcome));
+    return;
+  }
+
+  if (BluetoothBlacklist::Get().IsExcludedFromWrites(
+          query_result.characteristic->GetUUID())) {
+    RecordCharacteristicWriteValueOutcome(UMAGATTOperationOutcome::BLACKLISTED);
+    callback.Run(blink::mojom::WebBluetoothError::BLACKLISTED_WRITE);
+    return;
+  }
+
+  query_result.characteristic->WriteRemoteCharacteristic(
+      value.To<std::vector<uint8_t>>(),
+      base::Bind(&WebBluetoothServiceImpl::OnWriteValueSuccess,
+                 weak_ptr_on_ui_thread_, callback),

[Ken Rockot(use gerrit already), 2016/03/17 18:16:13]

As discussed previously, it's generally unsafe to pass response callbacks to
other threads, since they are not allowed to be destroyed on those threads.
Previously I suggested that we're safe in this case because the service impl
lives on the main thread which outlive whatever background thread this goes to.

I don't think that actually makes sense. +amistry since I know he's thought a
good bit about bindings threading issues. We need to address this ASAP as it
seems most services will have to deal with it in some form or another.

[ortuno, 2016/03/18 01:19:20]

As discussed offline, it's ok to do this for the time being. I opened an issue
that blocks our transition on it. Will wrap the callbacks when the wrapper is
available. http://crbug.com/595940

+      base::Bind(&WebBluetoothServiceImpl::OnWriteValueFailed,
+                 weak_ptr_on_ui_thread_, callback));
+}
+
+void WebBluetoothServiceImpl::OnWriteValueSuccess(
+    const RemoteCharacteristicWriteValueCallback& callback) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RecordCharacteristicWriteValueOutcome(UMAGATTOperationOutcome::SUCCESS);
+  callback.Run(blink::mojom::WebBluetoothError::SUCCESS);
+}
+
+void WebBluetoothServiceImpl::OnWriteValueFailed(
+    const RemoteCharacteristicWriteValueCallback& callback,
+    device::BluetoothGattService::GattErrorCode error_code) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  callback.Run(TranslateGATTErrorAndRecord(
+      error_code, UMAGATTOperation::CHARACTERISTIC_WRITE));
+}
+
+BluetoothDispatcherHost* WebBluetoothServiceImpl::GetBluetoothDispatcherHost() {
+  RenderProcessHostImpl* render_process_host_impl =
+      static_cast<RenderProcessHostImpl*>(render_process_host_);
+  return render_process_host_impl->GetBluetoothDispatcherHost();
+}
+
+void WebBluetoothServiceImpl::CrashRenderer(
+    bad_message::BadMessageReason reason) {
+  bad_message::ReceivedBadMessage(render_process_host_, reason);
+}
+
+url::Origin WebBluetoothServiceImpl::GetOrigin() {
+  return render_frame_host_->GetLastCommittedOrigin();
+}
+
+}  // namespace content