<webview>: First stab at implementing media permission request for guests.

content/browser/browser_plugin/browser_plugin_guest.h

Index: content/browser/browser_plugin/browser_plugin_guest.h
diff --git a/content/browser/browser_plugin/browser_plugin_guest.h b/content/browser/browser_plugin/browser_plugin_guest.h
index f4a36614fe69c6952d07e53f784c7094d9e6f3c9..d7a216bb8c2e040f3b129c6fd28a1fe02a3785f8 100644
--- a/content/browser/browser_plugin/browser_plugin_guest.h
+++ b/content/browser/browser_plugin/browser_plugin_guest.h
@@ -38,8 +38,8 @@
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebDragOperation.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebDragStatus.h"
 #include "ui/gfx/rect.h"
 
 struct BrowserPluginHostMsg_AutoSize_Params;
@@ -59,6 +59,7 @@ namespace content {
 class BrowserPluginHostFactory;
 class BrowserPluginEmbedder;
 class RenderProcessHost;
+struct MediaStreamRequest;
 
 // A browser plugin guest provides functionality for WebContents to operate in
 // the guest role and implements guest specific overrides for ViewHostMsg_*
@@ -134,6 +135,10 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
   virtual void RunFileChooser(WebContents* web_contents,
                               const FileChooserParams& params) OVERRIDE;
   virtual bool ShouldFocusPageAfterCrash() OVERRIDE;
+  virtual void RequestMediaAccessPermission(
+      WebContents* web_contents,
+      const content::MediaStreamRequest* request,
+      const content::MediaResponseCallback& callback) OVERRIDE;
 
   void UpdateRect(RenderViewHost* render_view_host,
                   const ViewHostMsg_UpdateRect_Params& params);
@@ -200,6 +205,11 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
   // web contents.
   void Resize(RenderViewHost* embedder_rvh,
               const BrowserPluginHostMsg_ResizeGuest_Params& params);
+  // Allows or denies a media access request, after the embedder has had a
+  // chance to decide.
+  void AllowMediaAccess(WebContents* embedder_web_contents,
+                        int request_id,
+                        bool should_allow);
 
   // Overridden in tests.
   // Handles input event routed through the embedder (which is initiated in the
@@ -227,6 +237,11 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
                                float scale_factor);
 
  private:
+  typedef std::pair<content::MediaStreamRequest, content::MediaResponseCallback>
+      MediaStreamRequestAndCallbackPair;
+  typedef std::map<int, MediaStreamRequestAndCallbackPair>
+      MediaStreamRequestsMap;
+
   friend class TestBrowserPluginGuest;
 
   BrowserPluginGuest(int instance_id,
@@ -281,6 +296,14 @@ class CONTENT_EXPORT BrowserPluginGuest : public NotificationObserver,
   bool auto_size_;
   gfx::Size max_auto_size_;
   gfx::Size min_auto_size_;
+  // A counter to generate unique request id for a media access request.
+  // We only need the ids to be unique for a given BrowserPluginGuest.
+  int current_media_access_request_id_;
+  // A map to store WebContents's media request object and callback.
+  // We need to store these because we need a roundtrip to the embedder to know
+  // if we allow or disallow the request. The key of the map is unique only for
+  // a given BrowserPluginGuest.

[Charlie Reis, 2012/11/20 01:54:00]

I wonder if we should put a (generous) cap on this map's size.  Otherwise a web
page could presumably generate requests in a loop to allocate arbitrary amounts
of memory in the browser process, right?

[lazyboy, 2012/11/20 02:55:20]

That is true, added check for limit, we deny media permissions if there are more
than thousand requests pending, although that might seem wrong if we already
allowed permission once and suddenly stopped allowing permissions. But hopefully
that would happen when the guest is trying to do some funny business. So it
should be OK to deny.
Thanks for catching this, I'll keep this in mind for similar code paths we're
adding for browser plugin.

+  MediaStreamRequestsMap media_requests_map_;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserPluginGuest);
 };