[Cross-Site Isolation] Migrate entire MediaStream verticals to be per-RenderFrame.

chrome/browser/media/desktop_streams_registry.h

Index: chrome/browser/media/desktop_streams_registry.h
diff --git a/chrome/browser/media/desktop_streams_registry.h b/chrome/browser/media/desktop_streams_registry.h
index 90fb3651722c442879baaf395f7d9ae01c49ad60..f0ea6ace917f76ae7f5fef5e792fa4ea718ea355 100644
--- a/chrome/browser/media/desktop_streams_registry.h
+++ b/chrome/browser/media/desktop_streams_registry.h
@@ -11,6 +11,10 @@
 #include "chrome/browser/media/desktop_media_list.h"
 #include "url/gurl.h"
 
+namespace content {
+class WebContents;
+}
+
 // DesktopStreamsRegistry is used to store accepted desktop media streams for
 // Desktop Capture API. Single instance of this class is created per browser in
 // MediaCaptureDevicesDispatcher.
@@ -22,29 +26,31 @@ class DesktopStreamsRegistry {
   // Adds new stream to the registry. Called by the implementation of
   // desktopCapture.chooseDesktopMedia() API after user has approved access to
   // |source| for the |origin|. Returns identifier of the new stream.
-  std::string RegisterStream(int render_process_id,
-                             int render_view_id,
+  // Note: |web_contents| refers to the WebContents requesting the stream. The
+  // |web_contents| pointer is only used for verification, and will never be
+  // dereferenced.
+  std::string RegisterStream(const content::WebContents* web_contents,

[ncarter (slow), 2014/07/10 01:17:51]

My expectation of which types to use where goes something like:
 - WebContents* to be used when we want to identify a tab whose output is being
captured.
 - A RenderFrameHost (or routing pair identifying a rfh) to be used to identify
the initiator of the capture. Because it's always going to be a particular
document that requests a capture stream.

A WebContents, over its lifetime, may navigate from a chrome-extension:// page
to a http://evil.com page and back. Our design must ensure that extensionlike
abilities aren't granted to evil.com; we do that by scoping this kind of
permission to a RenderFrameHost.

                              const GURL& origin,
                              const content::DesktopMediaID& source,
                              const std::string& extension_name);
 
   // Validates stream identifier specified in getUserMedia(). Returns null
   // DesktopMediaID if the specified |id| is invalid, i.e. wasn't generated
-  // using RegisterStream() or if it was generated for a different origin.
-  // Otherwise returns ID of the source and removes it from the registry.
-  content::DesktopMediaID RequestMediaForStreamId(const std::string& id,
-                                                  int render_process_id,
-                                                  int render_view_id,
-                                                  const GURL& origin,
-                                                  std::string* extension_name);
+  // using RegisterStream() or if it was generated for a different
+  // web_contents/origin. Otherwise returns ID of the source and removes it from
+  // the registry.
+  content::DesktopMediaID RequestMediaForStreamId(
+      const std::string& id,
+      const content::WebContents* web_contents,
+      const GURL& origin,
+      std::string* extension_name);
 
  private:
   // Type used to store list of accepted desktop media streams.
   struct ApprovedDesktopMediaStream {
     ApprovedDesktopMediaStream();
 
-    int render_process_id;
-    int render_view_id;
+    const content::WebContents* web_contents;  // Never dereference this!

[ncarter (slow), 2014/07/10 01:17:51]

Because of the possibility of address reuse, pointers that are unsafe to
dereference are also unsafe to use as keys.

[miu, 2014/07/10 22:16:12]

Good insight.  Fixed.

     GURL origin;
     content::DesktopMediaID source;
     std::string extension_name;