Convert offscreen canvas to use FrameSinkManagerHost.

content/browser/renderer_host/offscreen_canvas_provider_impl.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/renderer_host/offscreen_canvas_surface_factory_impl.h"
+#include "content/browser/renderer_host/offscreen_canvas_provider_impl.h"
 
-#include "base/memory/ptr_util.h"
-#include "cc/surfaces/frame_sink_id.h"
+#include "content/browser/compositor/surface_utils.h"
+#include "content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_manager.h"
 #include "content/browser/renderer_host/offscreen_canvas_surface_impl.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 
 namespace content {
 
-// static
-void OffscreenCanvasSurfaceFactoryImpl::Create(
-    blink::mojom::OffscreenCanvasSurfaceFactoryRequest request) {
-  mojo::MakeStrongBinding(base::MakeUnique<OffscreenCanvasSurfaceFactoryImpl>(),
-                          std::move(request));
+OffscreenCanvasProviderImpl::OffscreenCanvasProviderImpl() {}
+
+OffscreenCanvasProviderImpl::~OffscreenCanvasProviderImpl() {}
+
+void OffscreenCanvasProviderImpl::Add(
+    blink::mojom::OffscreenCanvasProviderRequest request) {
+  bindings_.AddBinding(this, std::move(request));
 }
 
-void OffscreenCanvasSurfaceFactoryImpl::CreateOffscreenCanvasSurface(
+void OffscreenCanvasProviderImpl::CreateOffscreenCanvasSurface(
     const cc::FrameSinkId& parent_frame_sink_id,
     const cc::FrameSinkId& frame_sink_id,
     cc::mojom::FrameSinkManagerClientPtr client,
     blink::mojom::OffscreenCanvasSurfaceRequest request) {
   OffscreenCanvasSurfaceImpl::Create(parent_frame_sink_id, frame_sink_id,
                                      std::move(client), std::move(request));
 }
 
+void OffscreenCanvasProviderImpl::CreateCompositorFrameSink(
+    const cc::FrameSinkId& frame_sink_id,
+    cc::mojom::MojoCompositorFrameSinkClientPtr client,
+    cc::mojom::MojoCompositorFrameSinkRequest request) {
+  auto* manager = OffscreenCanvasCompositorFrameSinkManager::GetInstance();
+  auto* surface_impl = manager->GetSurfaceInstance(frame_sink_id);
+  DCHECK(surface_impl);

[piman, 2017/04/12 18:08:43]

What makes this DCHECK valid? frame_sink_id comes from the (untrusted) renderer,
right? It could give an arbitrary value that makes the lookup fail.

[kylechar, 2017/04/12 18:48:35]

It would dereference the nullptr and (probably?) crash. I've changed it to
verify the lookup is successful. Done.

piman/tsepez: I never really thought about this before. What are the security
implications of dereferencing a pointer to nullptr? I know it's UB, although I
sort of figured it would always seg fault. Is this potentially exploitable?

[piman, 2017/04/12 19:07:43]

3 things:
1- UB is UB and the compiler is allowed to make assumptions that it can never
happen. There are famous security vulnerabilities introduced by things similar
to this (see e.g.
https://people.csail.mit.edu/nickolai/papers/wang-undef-2012-08-21.pdf ). I
don't know that it would be the case today for this, but compilers get smarter
every day.
2- CreateCompositorFrameSink is not virtual, so it wouldn't segfault here. It
might segfault in the implementation, or we might add |this| (now NULL) to a
container, and later assume it's not NULL etc.
3- segfaulting the browser from the renderer is bad anyway, let's not do it.

+  surface_impl->CreateCompositorFrameSink(std::move(client),
+                                          std::move(request));
+}
+
 }  // namespace content