Convert offscreen canvas to use FrameSinkManagerHost.

content/browser/renderer_host/offscreen_canvas_provider_impl.cc

Index: content/browser/renderer_host/offscreen_canvas_provider_impl.cc
diff --git a/content/browser/renderer_host/offscreen_canvas_surface_factory_impl.cc b/content/browser/renderer_host/offscreen_canvas_provider_impl.cc
similarity index 37%
rename from content/browser/renderer_host/offscreen_canvas_surface_factory_impl.cc
rename to content/browser/renderer_host/offscreen_canvas_provider_impl.cc
index 8d101f19d6ae71c9cf0d5ecc9d8a608a8bbeff7c..5f812b02e2267e390f9032ad06689ef7742d9ad1 100644
--- a/content/browser/renderer_host/offscreen_canvas_surface_factory_impl.cc
+++ b/content/browser/renderer_host/offscreen_canvas_provider_impl.cc
@@ -2,23 +2,24 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/renderer_host/offscreen_canvas_surface_factory_impl.h"
+#include "content/browser/renderer_host/offscreen_canvas_provider_impl.h"
 
-#include "base/memory/ptr_util.h"
-#include "cc/surfaces/frame_sink_id.h"
+#include "content/browser/compositor/surface_utils.h"
+#include "content/browser/renderer_host/offscreen_canvas_compositor_frame_sink_manager.h"
 #include "content/browser/renderer_host/offscreen_canvas_surface_impl.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 
 namespace content {
 
-// static
-void OffscreenCanvasSurfaceFactoryImpl::Create(
-    blink::mojom::OffscreenCanvasSurfaceFactoryRequest request) {
-  mojo::MakeStrongBinding(base::MakeUnique<OffscreenCanvasSurfaceFactoryImpl>(),
-                          std::move(request));
+OffscreenCanvasProviderImpl::OffscreenCanvasProviderImpl() {}
+
+OffscreenCanvasProviderImpl::~OffscreenCanvasProviderImpl() {}
+
+void OffscreenCanvasProviderImpl::Add(
+    blink::mojom::OffscreenCanvasProviderRequest request) {
+  bindings_.AddBinding(this, std::move(request));
 }
 
-void OffscreenCanvasSurfaceFactoryImpl::CreateOffscreenCanvasSurface(
+void OffscreenCanvasProviderImpl::CreateOffscreenCanvasSurface(
     const cc::FrameSinkId& parent_frame_sink_id,
     const cc::FrameSinkId& frame_sink_id,
     cc::mojom::FrameSinkManagerClientPtr client,
@@ -27,4 +28,15 @@ void OffscreenCanvasSurfaceFactoryImpl::CreateOffscreenCanvasSurface(
                                      std::move(client), std::move(request));
 }
 
+void OffscreenCanvasProviderImpl::CreateCompositorFrameSink(
+    const cc::FrameSinkId& frame_sink_id,
+    cc::mojom::MojoCompositorFrameSinkClientPtr client,
+    cc::mojom::MojoCompositorFrameSinkRequest request) {
+  auto* manager = OffscreenCanvasCompositorFrameSinkManager::GetInstance();
+  auto* surface_impl = manager->GetSurfaceInstance(frame_sink_id);
+  DCHECK(surface_impl);

[piman, 2017/04/12 18:08:43]

What makes this DCHECK valid? frame_sink_id comes from the (untrusted) renderer,
right? It could give an arbitrary value that makes the lookup fail.

[kylechar, 2017/04/12 18:48:35]

It would dereference the nullptr and (probably?) crash. I've changed it to
verify the lookup is successful. Done.

piman/tsepez: I never really thought about this before. What are the security
implications of dereferencing a pointer to nullptr? I know it's UB, although I
sort of figured it would always seg fault. Is this potentially exploitable?

[piman, 2017/04/12 19:07:43]

3 things:
1- UB is UB and the compiler is allowed to make assumptions that it can never
happen. There are famous security vulnerabilities introduced by things similar
to this (see e.g.
https://people.csail.mit.edu/nickolai/papers/wang-undef-2012-08-21.pdf ). I
don't know that it would be the case today for this, but compilers get smarter
every day.
2- CreateCompositorFrameSink is not virtual, so it wouldn't segfault here. It
might segfault in the implementation, or we might add |this| (now NULL) to a
container, and later assume it's not NULL etc.
3- segfaulting the browser from the renderer is bad anyway, let's not do it.

+  surface_impl->CreateCompositorFrameSink(std::move(client),
+                                          std::move(request));
+}
+
 }  // namespace content