Prevent browser crash resulting from misbehaving WebVR renderer requesting multiple VSyncs.

third_party/WebKit/Source/modules/vr/VRDisplay.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/vr/VRDisplay.h"
 
 #include "core/css/StylePropertySet.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/DocumentUserGestureToken.h"
 #include "core/dom/FrameRequestCallback.h"
@@ skipping 143 matching lines @@
   }
 }
 
 int VRDisplay::requestAnimationFrame(FrameRequestCallback* callback) {
   Document* doc = this->document();
   if (!doc)
     return 0;
   m_pendingRaf = true;
   if (!m_vrVSyncProvider.is_bound()) {
     ConnectVSyncProvider();
-  } else if (!m_displayBlurred) {
+  } else if (!m_displayBlurred && !m_pendingVsync) {
+    m_pendingVsync = true;
     m_vrVSyncProvider->GetVSync(convertToBaseCallback(
         WTF::bind(&VRDisplay::OnVSync, wrapWeakPersistent(this))));
   }
   callback->m_useLegacyTimeBase = false;
   return ensureScriptedAnimationController(doc).registerCallback(callback);
 }
 
 void VRDisplay::cancelAnimationFrame(int id) {
   if (!m_scriptedAnimationController)
     return;
@@ skipping 466 matching lines @@
 }
 
 void VRDisplay::OnDeactivate(
     device::mojom::blink::VRDisplayEventReason reason) {
   m_navigatorVR->enqueueVREvent(VRDisplayEvent::create(
       EventTypeNames::vrdisplaydeactivate, true, false, this, reason));
 }
 
 void VRDisplay::OnVSync(device::mojom::blink::VRPosePtr pose,
                         mojo::common::mojom::blink::TimeDeltaPtr time,
-                        int16_t frameId) {
-  WTF::TimeDelta timeDelta =
-      WTF::TimeDelta::FromMicroseconds(time->microseconds);
-  // The VSync provider cannot shut down before replying to pending callbacks,
-  // so it will send a null pose with no timestamp to be ignored.
-  if (pose.is_null() && timeDelta.is_zero()) {
-    // We need to keep the VSync loop going because we haven't responded to the
-    // previous rAF yet.
-    m_vrVSyncProvider->GetVSync(convertToBaseCallback(
-        WTF::bind(&VRDisplay::OnVSync, wrapWeakPersistent(this))));
-    return;
+                        int16_t frameId,
+                        device::mojom::blink::VRVSyncProvider::Error error) {
+  switch (error) {
+    case device::mojom::blink::VRVSyncProvider::Error::ERROR_NONE:
+      break;
+    case device::mojom::blink::VRVSyncProvider::Error::ERROR_TRY_AGAIN:
+      m_vrVSyncProvider->GetVSync(convertToBaseCallback(
+          WTF::bind(&VRDisplay::OnVSync, wrapWeakPersistent(this))));
+      return;
+    case device::mojom::blink::VRVSyncProvider::Error::ERROR_BAD_REQUEST:
+      // The renderer will probably be killed at this point.
+      return;
   }
+  m_pendingVsync = false;
   if (m_displayBlurred)
     return;
   if (!m_scriptedAnimationController)
     return;
   Document* doc = this->document();
   if (!doc)
     return;
 
+  WTF::TimeDelta timeDelta =
+      WTF::TimeDelta::FromMicroseconds(time->microseconds);
   // Ensure a consistent timebase with document rAF.
   if (m_timebase < 0) {
     m_timebase = WTF::monotonicallyIncreasingTime() - timeDelta.InSecondsF();
   }
 
   AutoReset<bool> animating(&m_inAnimationFrame, true);
   m_framePose = std::move(pose);
   m_vrFrameId = frameId;
   m_pendingRaf = false;
   m_scriptedAnimationController->serviceScriptedAnimations(
       m_timebase + timeDelta.InSecondsF());
 }
 
 void VRDisplay::ConnectVSyncProvider() {
-  if (!m_navigatorVR->isFocused())
+  if (!m_navigatorVR->isFocused() || m_vrVSyncProvider.is_bound())
     return;
   m_display->GetVRVSyncProvider(mojo::MakeRequest(&m_vrVSyncProvider));
   if (m_pendingRaf && !m_displayBlurred) {
+    m_pendingVsync = true;
     m_vrVSyncProvider->GetVSync(convertToBaseCallback(
         WTF::bind(&VRDisplay::OnVSync, wrapWeakPersistent(this))));
   }
 }
 
 void VRDisplay::onFullscreenCheck(TimerBase*) {
   if (!m_isPresenting) {
     m_fullscreenCheckTimer.stop();
     return;
   }
@@ skipping 74 matching lines @@
   visitor->trace(m_stageParameters);
   visitor->trace(m_eyeParametersLeft);
   visitor->trace(m_eyeParametersRight);
   visitor->trace(m_layer);
   visitor->trace(m_renderingContext);
   visitor->trace(m_scriptedAnimationController);
   visitor->trace(m_pendingPresentResolvers);
 }
 
 }  // namespace blink