New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 763905 link

Starred by 0 users

Issue metadata

Status: Fixed
Owner:
Last visit > 30 days ago
Closed: Nov 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 3
Type: Bug



Sign in to add a comment

Avoid passing naked pointer to MediaStreamManager::DeviceRequest

Project Member Reported by c.pa...@samsung.com, Sep 11 2017

Issue description

Currently, DeviceRequest takes a raw pointer to MSDH(as a MediaStreamRequester) and a null pointer in case of MEDIA_DEVICE_ACCESS.
We can refactor DeviceRequest to take a callback instead and remove MediaStreamRequester altogether.

guidou@chromium.org: WDYT? Can we do this?
 

Comment 1 by guidou@chromium.org, Sep 12 2017

Note that there are 4 different MSR methods that are invoked by MSM.
Does this mean that you need to pass 4 different callbacks? What would be the benefit?

Comment 2 by c.pa...@samsung.com, Sep 13 2017

Currently, we have three instances of DeviceRequest getting created on the basis of MediaStreamRequestType. MEDIA_DEVICE_ACCESS already uses a callback. So, I guess we need to add one callback each for MEDIA_GENERATE_STREAM and MEDIA_OPEN_DEVICE_PEPPER_ONLY.
The benefit that I see is to prevent use after free issues by avoiding passing of a naked pointer. Is it not possible that MSDH might be deleted and MSM still has a reference to it?

Comment 3 by guidou@chromium.org, Sep 13 2017

The naked pointer issue is orthogonal to using callbacks.
You can pass naked pointers using callbacks and you can avoid the naked pointer without callbacks, so that's not a reason to switch to callbacks.

Whatever solution you find to avoid passing the naked pointer with a callback you can probably also use it to avoid passing the naked pointer with the current approach.

Comment 4 by c.pa...@samsung.com, Sep 13 2017

Sure. My intention here was to avoid passing the naked pointer irrespective of whether we use callbacks or not. So, should we take this forward or drop the bug? Your suggestion please?

I also see that there's a TODO for DeviceRequest at https://cs.chromium.org/chromium/src/content/browser/renderer_host/media/media_stream_manager.cc?type=cs&q=DeviceRequest&l=225. However, that's not related to passing of naked pointer to DeviceRequest.

Comment 5 by guidou@chromium.org, Sep 13 2017

Avoiding the naked pointer is a good idea, so feel free to go for it. 
I can provide the reviews.

The TODO is a bit more involved, but you can try that afterwards if you want to.
If you want to keep making contributions in this area, I can point you to a couple of other interesting bugs related to Mojification and migrating from content to Blink which would provide more benefits than addressing the TODO.

Comment 6 by c.pa...@samsung.com, Sep 13 2017

If you have any approach in mind w.r.t avoiding the naked pointer, do let me know.

Sure. I am looking forward to some non-trivial contributions in this area. I had completed migration of media stream IPC messages to Mojo(bug:  742682 ) of late. Thanks.

Comment 7 by guidou@chromium.org, Sep 13 2017

You can try replacing the naked pointers with weak pointers.

Comment 8 by c.pa...@samsung.com, Sep 14 2017

Owner: c.pa...@samsung.com
Status: Assigned (was: Untriaged)
Summary: Avoid passing naked pointer to MediaStreamManager::DeviceRequest (was: Refactor MediaStreamManager::DeviceRequest)
Project Member

Comment 9 by bugdroid1@chromium.org, Sep 14 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/6349dd63cee4e31c2c85824280b9c91df5dcfed9

commit 6349dd63cee4e31c2c85824280b9c91df5dcfed9
Author: Chandan Padhi <c.padhi@samsung.com>
Date: Thu Sep 14 14:59:57 2017

Pass weak pointer to MediaStreamManager::DeviceRequest

Currently, MediaStreamDispatcherHost(as MediaStreamRequester)
is passed as a naked pointer to DeviceRequest which may not be
safe. With this CL, we now pass a weak pointer to MSDH to avoid
use-after-free issues.
 

Bug:  763905 
Change-Id: Ib86c5ec670d09f8b643a624fbe64c896f33f3664
Reviewed-on: https://chromium-review.googlesource.com/665077
Reviewed-by: Guido Urdaneta <guidou@chromium.org>
Commit-Queue: Chandan Padhi <c.padhi@samsung.com>
Cr-Commit-Position: refs/heads/master@{#501950}
[modify] https://crrev.com/6349dd63cee4e31c2c85824280b9c91df5dcfed9/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
[modify] https://crrev.com/6349dd63cee4e31c2c85824280b9c91df5dcfed9/content/browser/renderer_host/media/media_stream_dispatcher_host.h
[modify] https://crrev.com/6349dd63cee4e31c2c85824280b9c91df5dcfed9/content/browser/renderer_host/media/media_stream_manager.cc
[modify] https://crrev.com/6349dd63cee4e31c2c85824280b9c91df5dcfed9/content/browser/renderer_host/media/media_stream_manager.h
[modify] https://crrev.com/6349dd63cee4e31c2c85824280b9c91df5dcfed9/content/browser/renderer_host/media/video_capture_unittest.cc

guidou@chromium.org: Do you feel there's anything else to be done w.r.t to this bug? If not, shall we close this one?
Status: Fixed (was: Assigned)
Closing this as Fixed.

Sign in to add a comment