Don't expose a LayerImpl reference to CompositorProxy.

third_party/WebKit/Source/platform/graphics/CompositorMutatorClient.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CompositorMutatorClient_h
 #define CompositorMutatorClient_h
 
+#include <map>
+#include <memory>
 #include "platform/PlatformExport.h"
+#include "platform/graphics/CompositorMutableProperties.h"
 #include "platform/heap/Handle.h"
 #include "public/platform/WebCompositorMutatorClient.h"
-#include <memory>
 
 namespace blink {
 
 class CompositorMutator;
 struct CompositorMutations;
 class CompositorMutationsTarget;
+class CompositorMutation;
 
 class PLATFORM_EXPORT CompositorMutatorClient
     : public WebCompositorMutatorClient {
  public:
   CompositorMutatorClient(CompositorMutator*, CompositorMutationsTarget*);
   virtual ~CompositorMutatorClient();
 
   void setNeedsMutate();
+  void registerCompositorProxy(uint64_t proxyId,
+                               uint64_t elementId,
+                               uint32_t mutableProperties);
+  void unregisterCompositorProxy(uint64_t proxyId);
 
   // cc::LayerTreeMutator
   bool Mutate(base::TimeTicks monotonicTime, cc::LayerTreeImpl*) override;
   void SetClient(cc::LayerTreeMutatorClient*) override;
   base::Closure TakeMutations() override;
 
   CompositorMutator* mutator() { return m_mutator.get(); }
 
   void setMutationsForTesting(std::unique_ptr<CompositorMutations>);
 
  private:
+  void snapshotLayerTree(const cc::LayerTreeImpl*,
+                         ProxyCompositorMutablePropertiesMap*) const;
+  void updateLayerTree(cc::LayerTreeImpl*,
+                       uint64_t elementId,
+                       const CompositorMutation*) const;
+  void updateMutations(uint64_t elementId, std::unique_ptr<CompositorMutation>);
+
   cc::LayerTreeMutatorClient* m_client;
   CompositorMutationsTarget* m_mutationsTarget;
+  std::map<uint64_t, std::pair<uint64_t, uint32_t>> m_inputProperties;

[smcgruer, 2017/03/20 14:31:51]

What threads access this? I suspect that
CompositorMutatorClient::[un]registerCompositorProxy might be called on the main
thread?

[Scott Funkenhauser, 2017/03/21 19:31:12]

It looks like registerCompositorProxy is called on the Compositor thread:
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/Compo...

UnregisterCompositorProxy is called from CompositorProxy::disconnect(), but I'm
not sure how to track down what thread that is called on.

I'm assuming unregisterCompositorProxy is called from the Compositor thread as
well, otherwise there is also an issue in CompositorWorkerProxyClientImpl.  In
the same [un]register calls the proxy is added / removed from (what appears to
me) a non-thread safe map. 

   // Accessed by main and compositor threads.
   CrossThreadPersistent<CompositorMutator> m_mutator;
   std::unique_ptr<CompositorMutations> m_mutations;
 };
 
 }  // namespace blink
 
 #endif  // CompositorMutatorClient_h