Ensure that the web contents trying to access native VR Shell is the webcontents we created.

chrome/browser/android/vr_shell/vr_shell.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/android/vr_shell/vr_shell.h"
 
 #include <thread>
 
 #include "chrome/browser/android/vr_shell/ui_scene.h"
 #include "chrome/browser/android/vr_shell/vr_compositor.h"
@@ skipping 470 matching lines @@
 }
 
 void VrShell::OnResume(JNIEnv* env, const JavaParamRef<jobject>& obj) {
   if (gvr_api_ == nullptr)
     return;
 
   gvr_api_->RefreshViewerProfile();
   gvr_api_->ResumeTracking();
 }
 
-base::WeakPtr<VrShell> VrShell::GetWeakPtr() {
-  // TODO: Ensure that only ui webcontents can request this weak ptr.
-  if (g_instance != nullptr)
+base::WeakPtr<VrShell> VrShell::GetWeakPtr(
+    const content::WebContents* web_contents) {
+  // Ensure that the WebContents requesting the VrShell instance is the one
+  // we created.
+  if (g_instance != nullptr &&
+      g_instance->ui_cvc_->GetWebContents() == web_contents)
     return g_instance->weak_ptr_factory_.GetWeakPtr();
   return base::WeakPtr<VrShell>(nullptr);
 }
 
 void VrShell::OnDomContentsLoaded() {
   // TODO(mthiesse): Setting the background to transparent after the DOM content
   // has loaded is a hack to work around the background not updating when we set
   // it to transparent unless we perform a very specific sequence of events.
   // First the page background must load as not transparent, then we set the
   // background of the renderer to transparent, then we update the page
@@ skipping 89 matching lines @@
       content::WebContents::FromJavaWebContents(content_web_contents));
   content::ContentViewCore* ui_core = content::ContentViewCore::FromWebContents(
       content::WebContents::FromJavaWebContents(ui_web_contents));
   return reinterpret_cast<intptr_t>(new VrShell(
       env, obj, c_core,
       reinterpret_cast<ui::WindowAndroid*>(content_window_android), ui_core,
       reinterpret_cast<ui::WindowAndroid*>(ui_window_android)));
 }
 
 }  // namespace vr_shell