Implement temporary reference assignment with DisplayCompositor.

cc/ipc/mojo_compositor_frame_sink.mojom

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 module cc.mojom;
 
 import "cc/ipc/begin_frame_args.mojom";
 import "cc/ipc/compositor_frame.mojom";
 import "cc/ipc/copy_output_request.mojom";
 import "cc/ipc/frame_sink_id.mojom";
 import "cc/ipc/local_surface_id.mojom";
-import "cc/ipc/surface_reference.mojom";
+import "cc/ipc/surface_id.mojom";
 import "cc/ipc/returned_resource.mojom";
 import "cc/ipc/surface_sequence.mojom";
 import "ui/gfx/geometry/mojo/geometry.mojom";
 
 // A MojoCompositorFrameSink is an interface for receiving CompositorFrame
 // structs. A CompositorFrame contains the complete output meant for display.
 // Each time a client has a graphical update, and receives an OnBeginFrame, it
 // is responsible for creating a CompositorFrame to update its portion of the
 // screen.
 interface MojoCompositorFrameSink {
@@ skipping 44 matching lines @@
   ReclaimResources(ReturnedResourceArray resources);
 
   // Called when surface is being scheduled for a draw.
   WillDrawSurface(LocalSurfaceId local_surface_id, gfx.mojom.Rect damage_rect);
 };
 
 // MojoCompositorFrameSinkPrivate is used by the display compositor host to
 // perform privilieged operations on a CompositorFrameSink such as
 // CopyOutputRequests.
 interface MojoCompositorFrameSinkPrivate {
+  // Claims this FrameSinkId will embed |surface_id| so it should own the
+  // temporary reference to |surface_id|.
+  ClaimTemporaryReference(SurfaceId surface_id);

[Tom Sepez, 2017/02/28 18:46:58]

can this fail?  how do things break if an ill-behaving client fails to call this
or unexpectedly releases it?

[kylechar, 2017/02/28 18:59:51]

MojoCompositorFrameSinkPrivate is the private interface between WS (or browser)
and GPU that is trusted. It corresponds to a MojoCompositorFrameSink interface
between the client and GPU that is untrusted.

We expect the WS to always respond correctly. If there is no temporary reference
(for example the client beat the WS by adding a reference) then this will "fail"
somewhere in the GPU but only because it's not needed. The WS doesn't need to
know if it fails, no further action is necessary.

+
   // Requests that the renderer send back a copy of the surface that this
   // CompositorFrameSink submits to. The result can be in form of a bitmap
   // or a texture. See cc::CopyOutputRequest.
   RequestCopyOfSurface(cc.mojom.CopyOutputRequest request);
 };