[Cross-Site Isolation] Migrate entire MediaStream verticals to be per-RenderFrame.

chrome/browser/media/desktop_streams_registry.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_MEDIA_DESKTOP_STREAMS_REGISTRY_H_
 #define CHROME_BROWSER_MEDIA_DESKTOP_STREAMS_REGISTRY_H_
 
 #include <map>
 #include <string>
 
 #include "chrome/browser/media/desktop_media_list.h"
 #include "url/gurl.h"
 
+namespace content {
+class WebContents;
+}
+
 // DesktopStreamsRegistry is used to store accepted desktop media streams for
 // Desktop Capture API. Single instance of this class is created per browser in
 // MediaCaptureDevicesDispatcher.
 class DesktopStreamsRegistry {
  public:
   DesktopStreamsRegistry();
   ~DesktopStreamsRegistry();
 
   // Adds new stream to the registry. Called by the implementation of
   // desktopCapture.chooseDesktopMedia() API after user has approved access to
   // |source| for the |origin|. Returns identifier of the new stream.
-  std::string RegisterStream(int render_process_id,
-                             int render_view_id,
+  // Note: |web_contents| refers to the WebContents requesting the stream. The
+  // |web_contents| pointer is only used for verification, and will never be
+  // dereferenced.
+  std::string RegisterStream(const content::WebContents* web_contents,

[ncarter (slow), 2014/07/10 01:17:51]

My expectation of which types to use where goes something like:
 - WebContents* to be used when we want to identify a tab whose output is being
captured.
 - A RenderFrameHost (or routing pair identifying a rfh) to be used to identify
the initiator of the capture. Because it's always going to be a particular
document that requests a capture stream.

A WebContents, over its lifetime, may navigate from a chrome-extension:// page
to a http://evil.com page and back. Our design must ensure that extensionlike
abilities aren't granted to evil.com; we do that by scoping this kind of
permission to a RenderFrameHost.

                              const GURL& origin,
                              const content::DesktopMediaID& source,
                              const std::string& extension_name);
 
   // Validates stream identifier specified in getUserMedia(). Returns null
   // DesktopMediaID if the specified |id| is invalid, i.e. wasn't generated
-  // using RegisterStream() or if it was generated for a different origin.
-  // Otherwise returns ID of the source and removes it from the registry.
-  content::DesktopMediaID RequestMediaForStreamId(const std::string& id,
-                                                  int render_process_id,
-                                                  int render_view_id,
-                                                  const GURL& origin,
-                                                  std::string* extension_name);
+  // using RegisterStream() or if it was generated for a different
+  // web_contents/origin. Otherwise returns ID of the source and removes it from
+  // the registry.
+  content::DesktopMediaID RequestMediaForStreamId(
+      const std::string& id,
+      const content::WebContents* web_contents,
+      const GURL& origin,
+      std::string* extension_name);
 
  private:
   // Type used to store list of accepted desktop media streams.
   struct ApprovedDesktopMediaStream {
     ApprovedDesktopMediaStream();
 
-    int render_process_id;
-    int render_view_id;
+    const content::WebContents* web_contents;  // Never dereference this!

[ncarter (slow), 2014/07/10 01:17:51]

Because of the possibility of address reuse, pointers that are unsafe to
dereference are also unsafe to use as keys.

[miu, 2014/07/10 22:16:12]

Good insight.  Fixed.

     GURL origin;
     content::DesktopMediaID source;
     std::string extension_name;
   };
   typedef std::map<std::string, ApprovedDesktopMediaStream> StreamsMap;
 
   // Helper function that removes an expired stream from the registry.
   void CleanupStream(const std::string& id);
 
   StreamsMap approved_streams_;
 
   DISALLOW_COPY_AND_ASSIGN(DesktopStreamsRegistry);
 };
 
 #endif  // CHROME_BROWSER_MEDIA_DESKTOP_STREAMS_REGISTRY_H_