CVE-2025-12430

High watch CVSS 7.5 chrome Logic Error 🔧 Commit mapped

Overview

High

Severity

7.5

CVSS

Exploited ITW

Fixed

Fix Status

ImpactObject lifecycle issue in Media

DescriptionObject lifecycle issue in Media

ComponentMedia

Bug ClassLogic Error

Action tierwatch — logic/policy bug — security-relevant, no memory-unsafety
Computed by PatchGap's deterministic exploitability ruler from the fixing commit. patch-now = RCE-class & attacker-reachable in a default config, or exploited in the wild; watch = real security signal below that bar; noise = no security relevance.

Tracker442860743

Fix commit51cf4b9f857b (chromium/src) +174/-135

CWECWE-290

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA KEVNot listed

Creditedround.about

Reported2025-09-04 · bounty $10000 (per vendor advisory)

Fix landed2025-09-25 (public git)

Disclosed2025-10-28

Patch gap33 days — fix public in source before the advisory

Background

`MediaStreamDispatcherHost`: the browser-process Mojo host (content/browser/renderer_host/media/media_stream_dispatcher_host.cc) that receives GenerateStreams requests from a renderer frame (backing getUserMedia/getDisplayMedia-style capture) and drives permission checks and capture-dialog flows.
`RenderFrameHostImpl::IsActive()`: reports whether a RenderFrameHost is the current, live document; it is false when the frame is, for example, pending deletion after navigation, stored in the back-forward cache, or prerendering.
`GenerateStreamsUIThreadCheckResult`: the result of UI-thread pre-checks handed back to the IO-thread request handler; the patch changes it from a {request_allowed, salt_and_origin} struct to base::expected<MediaDeviceSaltAndOrigin, MediaStreamRequestResult> so the failure reason is carried explicitly.
Soft-fail: completing a request with an error result (MediaStreamRequestResult::INVALID_STATE) rather than killing the renderer via ReceivedBadMessage, appropriate when a benign renderer can legitimately race a navigation.

Root Cause Analysis

Before the patch, the UI-thread check stage of GenerateStreams did not verify that the requesting RenderFrameHost was still active: the general path (the function containing the if (request_all_screens) branch) did no frame lookup in the shown code, and CheckRequestAllScreensAllowed only resolved the GlobalRenderFrameHostId and failed if the frame was null. A GenerateStreams request arriving from a document that had already been navigated away from (still existing as a non-active RenderFrameHost) was therefore propagated onward into the media-stream pipeline, which can lead to permission/capture UI being processed for a document that is no longer the one the user sees.

The fix adds, at the top of that UI-thread check function, a lookup via RenderFrameHostImpl::FromID(render_frame_host_id) and an early return that runs result_callback with INVALID_STATE if the frame is null or !IsActive(); this guard executes before either the all-screens or the regular path. CheckRequestAllScreensAllowed now receives the already-resolved RenderFrameHost* and repeats the null/IsActive() check, and the result type is converted to base::expected so the IO-thread handler forwards the precise error instead of a generic PERMISSION_DENIED. The commit message explicitly calls this a short-term fix: the frame can still deactivate asynchronously later in the pipeline before the dialog is shown, so the gap is narrowed rather than fully closed.

Key insight

The browser trusted that a GenerateStreams request still belonged to a live document, without checking the requesting frame’s lifecycle state. The fix tightens the UI-thread checks to soft-fail any request whose RenderFrameHost is missing or not IsActive().

Attack Path

Capture request near navigation A page issues a media capture request (GenerateStreams over Mojo) and the requesting frame navigates away (or otherwise becomes inactive) around the same time.
IO-to-UI hop MediaStreamDispatcherHost posts the request’s checks to the UI thread; by the time they run, the RenderFrameHost still exists but is no longer active.
Missing lifecycle check Pre-patch, the regular path continued without an IsActive() check (and the all-screens path checked only for null), so the request proceeded toward permission handling and capture UI on behalf of the inactive document.
Mis-attributed capture flow Permission or picker UI could then be associated with a document the user is no longer viewing, potentially letting a page obtain or prompt for capture in a confusing or mis-attributed context (inferred; the diff does not show the downstream dialog code).

Impact Assessment

This is a browser-process lifecycle/logic flaw rather than a demonstrated memory-corruption bug: the patch shows only that requests from inactive frames were allowed to proceed, and the concrete consequence (e.g., capture permission UI or capture state tied to a stale document, or a downstream lifetime hazard in the pipeline) is (inferred). The regular GenerateStreams path is reachable from ordinary web content in a stock build via media-capture APIs, but it requires winning a timing window between the request and the frame’s deactivation; the request_all_screens path additionally depends on the all-screens capture feature being allowed (the test enables GetAllScreensMedia and mocks IsMultiCaptureAllowed, which in practice is policy-gated (inferred)). The vendor rates it High severity; the provided metadata does not state in-the-wild exploitation, and the commit notes the fix is partial because later asynchronous deactivation is not yet handled.

Changed Functions

Function	Change	Notes
`if` content/browser/renderer_host/media/media_stream_dispatcher_host.cc	modified
`for` content/browser/renderer_host/media/media_stream_dispatcher_host.cc	modified

Files Changed

content/browser/renderer_host/media/media_stream_dispatcher_host.cc
content/browser/renderer_host/media/media_stream_dispatcher_host.h

Audit Directions

Browser-side handlers missing `IsActive()` checks
Audit other Mojo handlers that show permission prompts, pickers, or start capture/device access (MediaStreamDispatcherHost, MediaDevicesDispatcherHost, screen-capture and file/device chooser hosts) for requests from frames that are pending deletion, in BFCache, or prerendering.
Thread hops that re-resolve frames by ID
Look for flows that capture a GlobalRenderFrameHostId on the IO thread and later resolve it on the UI thread, checking only for null; the frame can exist but be inactive, or deactivate again before the UI is shown, as the commit itself warns.
Long-lived requests not bound to document lifetime
Check whether pending capture/permission requests are cancelled on navigation or DocumentUserData teardown, rather than relying on one up-front check that can be raced later in the pipeline.

Patch

view commit

From 51cf4b9f857beaad802f6019792cc84f62337150 Mon Sep 17 00:00:00 2001
From: Elad Alon <[email protected]>
Date: Thu, 25 Sep 2025 03:21:19 -0700
Subject: [PATCH] Avoid propagating GenerateStreams from inactive RFHs

Soft-fail GenerateStreams() calls from RFHs that are no longer active,
as is the case when navigating.

This is the short-term fix. In the long-term, it's also important to
associate the GenerateStreams message with the RFH in the rest of the
pipeline, as the RFH might still asynchronously deactivate at a later
time that is still before the dialog is shown to the user.

Bug: 442860743
Change-Id: Iaf322eb151ee6e916a24dd10468b2f0426216ac1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6966127
Commit-Queue: Elad Alon <[email protected]>
Reviewed-by: Simon Hangl <[email protected]>
Reviewed-by: Guido Urdaneta <[email protected]>
Reviewed-by: Daniel Cheng <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1520479}
---

diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index 7f8d221..6d3615cc 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
@@ -52,6 +52,7 @@
 namespace {
 
 using ::blink::mojom::CapturedSurfaceControlResult;
+using ::blink::mojom::MediaStreamRequestResult;
 
 void BindMediaStreamDeviceObserverReceiver(
     GlobalRenderFrameHostId render_frame_host_id,
@@ -359,10 +360,18 @@
         result_callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
+  RenderFrameHostImpl* const render_frame_host =
+      RenderFrameHostImpl::FromID(render_frame_host_id);
+  if (!render_frame_host || !render_frame_host->IsActive()) {
+    std::move(result_callback)
+        .Run(base::unexpected(MediaStreamRequestResult::INVALID_STATE));
+    return;
+  }
+
   if (request_all_screens) {
     CheckRequestAllScreensAllowed(std::move(get_salt_and_origin_cb),
                                   std::move(result_callback),
-                                  render_frame_host_id);
+                                  render_frame_host);
     return;
   }
 
@@ -376,15 +385,12 @@
         get_salt_and_origin_cb,
     base::OnceCallback<void(GenerateStreamsUIThreadCheckResult)>
         result_callback,
-    GlobalRenderFrameHostId render_frame_host_id) {
+    RenderFrameHost* render_frame_host) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  RenderFrameHostImpl* render_frame_host =
-      RenderFrameHostImpl::FromID(render_frame_host_id);
-  if (!render_frame_host) {
-    CheckStreamsPermissionResultReceived(std::move(get_salt_and_origin_cb),
-                                         std::move(result_callback),
-                                         /*result=*/false);
+  if (!render_frame_host || !render_frame_host->IsActive()) {
+    std::move(result_callback)
+        .Run(base::unexpected(MediaStreamRequestResult::INVALID_STATE));
     return;
   }
 
@@ -401,8 +407,7 @@
     bool result) {
   if (!result) {
     std::move(result_callback)
-        .Run({.request_allowed = false,
-              .salt_and_origin = MediaDeviceSaltAndOrigin::Empty()});
+        .Run(base::unexpected(MediaStreamRequestResult::PERMISSION_DENIED));
     return;
   }
 
@@ -410,8 +415,7 @@
       [](base::OnceCallback<void(GenerateStreamsUIThreadCheckResult)>
              result_callback,
          const MediaDeviceSaltAndOrigin& salt_and_origin) {
-        std::move(result_callback)
-            .Run({.request_allowed = true, .salt_and_origin = salt_and_origin});
+        std::move(result_callback).Run(salt_and_origin);
       },
       std::move(result_callback));
   std::move(get_salt_and_origin_cb).Run(std::move(got_salt_and_origin));
@@ -448,7 +452,7 @@
 
   for (auto& pending_request : pending_requests_) {
     std::move(pending_request->callback)
-        .Run(blink::mojom::MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN,
+        .Run(MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN,
              /*label=*/std::string(),
              /*stream_devices_set=*/nullptr,
              /*pan_tilt_zoom_allowed=*/false);
@@ -469,7 +473,7 @@
   const std::optional<bad_message::BadMessageReason> bad_message =
       ValidateControlsForGenerateStreams(controls);
   if (bad_message.has_value()) {
-    ReceivedBadMessage(render_frame_host_id_.child_id, bad_message.value());
+    ReceivedBadMessage(render_frame_host_id_.child_id, *bad_message);
     return;
   }
 
@@ -495,25 +499,21 @@
     GenerateStreamsUIThreadCheckResult ui_check_result) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  if (!ui_check_result.request_allowed) {
-    std::move(callback).Run(
-        blink::mojom::MediaStreamRequestResult::PERMISSION_DENIED,
-        /*label=*/std::string(),
-        /*stream_devices_set=*/nullptr,
-        /*pan_tilt_zoom_allowed=*/false);
+  if (!ui_check_result.has_value()) {
+    std::move(callback).Run(ui_check_result.error(),
+                            /*label=*/std::string(),
+                            /*stream_devices_set=*/nullptr,
+                            /*pan_tilt_zoom_allowed=*/false);
     return;
   }
 
-  MediaDeviceSaltAndOrigin salt_and_origin =
-      std::move(ui_check_result.salt_and_origin);
-  ui_check_result = {.salt_and_origin = MediaDeviceSaltAndOrigin::Empty()};
+  MediaDeviceSaltAndOrigin salt_and_origin = std::move(*ui_check_result);
   if (!MediaStreamManager::IsOriginAllowed(render_frame_host_id_.child_id,
                                            salt_and_origin.origin())) {
-    std::move(callback).Run(
-        blink::mojom::MediaStreamRequestResult::INVALID_SECURITY_ORIGIN,
-        /*label=*/std::string(),
-        /*stream_devices_set=*/nullptr,
-        /*pan_tilt_zoom_allowed=*/false);
+    std::move(callback).Run(MediaStreamRequestResult::INVALID_SECURITY_ORIGIN,
+                            /*label=*/std::string(),
+                            /*stream_devices_set=*/nullptr,
+                            /*pan_tilt_zoom_allowed=*/false);
     return;
   }
 
@@ -778,8 +778,7 @@
     ReceivedBadMessage(render_frame_host_id_.child_id,
                        bad_message::MSDH_GET_OPEN_DEVICE_USE_WITHOUT_FEATURE);
 
-    std::move(callback).Run(
-        blink::mojom::MediaStreamRequestResult::NOT_SUPPORTED, nullptr);
+    std::move(callback).Run(MediaStreamRequestResult::NOT_SUPPORTED, nullptr);
     return;
   }
   // TODO(crbug.com/40058526): Decide whether we need to have another
@@ -806,9 +805,8 @@
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!MediaStreamManager::IsOriginAllowed(render_frame_host_id_.child_id,
                                            salt_and_origin.origin())) {
-    std::move(callback).Run(
-        blink::mojom::MediaStreamRequestResult::INVALID_SECURITY_ORIGIN,
-        nullptr);
+    std::move(callback).Run(MediaStreamRequestResult::INVALID_SECURITY_ORIGIN,
+                            nullptr);
     return;
   }
 
diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host.h b/content/browser/renderer_host/media/media_stream_dispatcher_host.h
index ed30ead..40cf9ce 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host.h
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host.h
@@ -13,6 +13,7 @@
 #include "base/memory/scoped_refptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/synchronization/lock.h"
+#include "base/types/expected.h"
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/media/media_devices_util.h"
@@ -72,10 +73,9 @@
   FRIEND_TEST_ALL_PREFIXES(MediaStreamDispatcherHostMultiCaptureTest,
                            PolicySetMultiCaptureAllowed);
 
-  struct GenerateStreamsUIThreadCheckResult {
-    bool request_allowed = false;
-    MediaDeviceSaltAndOrigin salt_and_origin;
-  };
+  using GenerateStreamsUIThreadCheckResult =
+      ::base::expected<::content::MediaDeviceSaltAndOrigin,
+                       ::blink::mojom::MediaStreamRequestResult>;
 
   struct PendingAccessRequest;
   using RequestsQueue =
@@ -98,7 +98,7 @@
           get_salt_and_origin_cb,
       base::OnceCallback<void(GenerateStreamsUIThreadCheckResult)>

Loading diff…

Regression Test / PoC

shipped with the fix

diff --git a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
index 3c4c139..1666996f 100644
--- a/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
+++ b/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
@@ -68,17 +68,22 @@
 #endif
 
 using ::blink::mojom::CapturedSurfaceControlResult;
+using ::blink::mojom::MediaStreamRequestResult;
 using ::blink::mojom::MediaStreamType;
 using ::testing::_;
+using ::testing::Bool;
 using ::testing::InSequence;
 using ::testing::InvokeWithoutArgs;
 using ::testing::Return;
 
+using GenerateStreamsUIThreadCheckResult =
+    ::base::expected<::content::MediaDeviceSaltAndOrigin,
+                     ::blink::mojom::MediaStreamRequestResult>;
+
 namespace content {
 
 namespace {
 
-const GlobalRenderFrameHostId kRenderFrameHostId{5, 6};
 constexpr int kRequesterId = 7;
 constexpr int kPageRequestId = 8;
 constexpr const char* kRegularVideoDeviceId1 = "stub_device_1";
@@ -144,8 +149,7 @@
                void(int request_id,
                     const blink::mojom::StreamDevicesSet& stream_devices_set));
   MOCK_METHOD2(OnStreamGenerationFailure,
-               void(int request_id,
-                    blink::mojom::MediaStreamRequestResult result));
+               void(int request_id, MediaStreamRequestResult result));
   MOCK_METHOD0(OnDeviceStopSuccess, void());
   MOCK_METHOD0(OnDeviceOpenSuccess, void());
 
@@ -221,11 +225,11 @@
  private:
   // These handler methods do minimal things and delegate to the mock methods.
   void OnStreamsGenerated(int request_id,
-                          blink::mojom::MediaStreamRequestResult result,
+                          MediaStreamRequestResult result,
                           const std::string& label,
                           blink::mojom::StreamDevicesSetPtr stream_devices_set,
                           bool pan_tilt_zoom_allowed) {
-    if (result != blink::mojom::MediaStreamRequestResult::OK) {
+    if (result != MediaStreamRequestResult::OK) {
       DCHECK(!stream_devices_set);
       OnStreamGenerationFailed(request_id, result);
       return;
@@ -242,7 +246,7 @@
   }
 
   void OnStreamGenerationFailed(int request_id,
-                                blink::mojom::MediaStreamRequestResult result) {
+                                MediaStreamRequestResult result) {
     OnStreamGenerationFailure(request_id, result);
     if (!quit_closures_.empty()) {
       task_runner_->PostTask(FROM_HERE, std::move(quit_closures_.front()));
@@ -289,7 +293,7 @@
       : FakeMediaStreamUIProxy(/*tests_use_fake_render_frame_hosts=*/true) {}
   void OnStarted(
       base::OnceClosure stop,
-      content::MediaStreamUI::SourceCallback source,
+      MediaStreamUI::SourceCallback source,
       MediaStreamUIProxy::WindowIdCallback window_id_callback,
       const std::string& label,
       std::vector<DesktopMediaID> screen_share_ids,
@@ -301,12 +305,27 @@
   MOCK_METHOD1(MockOnStarted, void(base::OnceClosure& stop));
 };
 
-class MediaStreamDispatcherHostTest : public testing::Test {
+class MockContentBrowserClient : public ContentBrowserClient {
+ public:
+  MOCK_METHOD(bool,
+              IsMultiCaptureAllowed,
+              (RenderFrameHost * render_frame_host),
+              (override));
+};
+
+class MediaStreamDispatcherHostTest : public RenderViewHostTestHarness {
  public:
   MediaStreamDispatcherHostTest()
-      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP),
+      : RenderViewHostTestHarness(
+#if BUILDFLAG(IS_CHROMEOS) || BUILDFLAG(IS_WIN)
+            base::test::TaskEnvironment::MainThreadType::UI),
+#else
+            base::test::TaskEnvironment::MainThreadType::IO),
+#endif
         salt_and_origin_(CreateRandomMediaDeviceIDSalt(),
                          url::Origin::Create(GURL("https://test.com"))) {
+    SetBrowserClientForTesting(&content_browser_client_);
+
     scoped_feature_list_
         .InitFromCommandLine(/*enable_features=*/
                              "UserMediaCaptureOnFocus,GetAllScreensMedia",
@@ -328,8 +347,16 @@
         audio_system_.get(), std::move(mock_video_capture_provider));
     salt_and_origin_.set_has_focus(true);
     salt_and_origin_.set_is_background(false);
+  }
+
+  ~MediaStreamDispatcherHostTest() override {}
+
+  void SetUp() override {
+    RenderViewHostTestHarness::SetUp();
+    RenderFrameHostTester::For(main_rfh())->InitializeRenderFrameIfNeeded();
+
     host_ = std::make_unique<MockMediaStreamDispatcherHost>(
-        kRenderFrameHostId, media_stream_manager_.get());
+        main_rfh()->GetGlobalId(), media_stream_manager_.get());
     host_->set_get_salt_and_origin_cb_for_testing(
         base::BindRepeating(&MediaStreamDispatcherHostTest::GetSaltAndOrigin,
                             base::Unretained(this)));
@@ -343,17 +370,8 @@
     ash::CrasAudioClient::InitializeFake();
     ash::CrasAudioHandler::InitializeForTesting();
 #endif
-  }
 
-  ~MediaStreamDispatcherHostTest() override {
-    audio_manager_->Shutdown();
-#if BUILDFLAG(IS_CHROMEOS)
-    ash::CrasAudioHandler::Shutdown();
-    ash::CrasAudioClient::Shutdown();
-#endif
-  }
 
-  void SetUp() override {
     stub_video_device_ids_.emplace_back(kRegularVideoDeviceId1);
     stub_video_device_ids_.emplace_back(kDepthVideoDeviceId);
     ON_CALL(*mock_video_capture_provider_, GetDeviceInfosAsync(_))
@@ -385,8 +403,18 @@
   }
 
   void TearDown() override {
+    mock_video_capture_provider_ = nullptr;
+
     host_->CancelAllRequests();
     host_.reset();
+
+    audio_manager_->Shutdown();
+#if BUILDFLAG(IS_CHROMEOS)
+    ash::CrasAudioHandler::Shutdown();
+    ash::CrasAudioClient::Shutdown();
+#endif
+
+    RenderViewHostTestHarness::TearDown();
   }
 
   void GetSaltAndOrigin(GlobalRenderFrameHostId,
@@ -438,7 +466,7 @@
   void GenerateStreamAndWaitForFailure(
       int page_request_id,
       const blink::StreamControls& controls,
-      blink::mojom::MediaStreamRequestResult expected_result) {
+      MediaStreamRequestResult expected_result) {
     base::RunLoop run_loop;
     EXPECT_CALL(*host_,
                 OnStreamGenerationFailure(page_request_id, expected_result));
@@ -564,11 +592,11 @@
   std::unique_ptr<MediaStreamManager> media_stream_manager_;
   std::unique_ptr<media::AudioManager> audio_manager_;
   std::unique_ptr<media::AudioSystem> audio_system_;
-  BrowserTaskEnvironment task_environment_;
   MediaDeviceSaltAndOrigin salt_and_origin_;
   media::AudioDeviceDescriptions audio_device_descriptions_;
   std::vector<std::string> stub_video_device_ids_;
   raw_ptr<MockVideoCaptureProvider> mock_video_capture_provider_;
+  MockContentBrowserClient content_browser_client_;
 };
 
 TEST_F(MediaStreamDispatcherHostTest, GenerateStreamWithVideoOnly) {
@@ -612,7 +640,7 @@
   EXPECT_CALL(
       *this,
       MockOnBadMessage(
-          kRenderFrameHostId.child_id,
+          main_rfh()->GetGlobalId().child_id,
           bad_message::
               MSDH_SUPPRESS_LOCAL_AUDIO_PLAYBACK_BUT_AUDIO_NOT_REQUESTED))
       .Times(1);
@@ -630,7 +658,7 @@
 
   EXPECT_CALL(*this,
               MockOnBadMessage(
-                  kRenderFrameHostId.child_id,
+                  main_rfh()->GetGlobalId().child_id,
                   bad_message::MSDH_HOTWORD_ENABLED_BUT_AUDIO_NOT_REQUESTED))
       .Times(1);
   host_->OnGenerateStreams(kPageRequestId, controls);
@@ -647,7 +675,7 @@
 
   EXPECT_CALL(*this,
               MockOnBadMessage(
-                  kRenderFrameHostId.child_id,
+                  main_rfh()->GetGlobalId().child_id,
                   bad_message::MSDH_DISABLE_LOCAL_ECHO_BUT_AUDIO_NOT_REQUESTED))
       .Times(1);
   host_->OnGenerateStreams(kPageRequestId, controls);
@@ -663,7 +691,7 @@
 
   EXPECT_CALL(*this,
               MockOnBadMessage(
-                  kRenderFrameHostId.child_id,
+                  main_rfh()->GetGlobalId().child_id,
                   bad_message::MSDH_RESTRICT_OWN_AUDIO_IS_SET_WHEN_UNSUPPORTED))
       .Times(media::IsRestrictOwnAudioSupported() ? 0 : 1);
   host_->OnGenerateStreams(kPageRequestId, controls);
@@ -677,7 +705,7 @@
 
   GenerateStreamAndWaitForFailure(
       kPageRequestId, controls,
-      blink::mojom::MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN);
+      MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN);
 }
 
 TEST_F(MediaStreamDispatcherHostTest, GenerateStreamWithAudioAndVideo) {
@@ -809,10 +837,12 @@
       video_device(/*stream_index=*/0u).value().session_id();
 
   // Generate second stream from another render frame.
+  std::unique_ptr<WebContents> other_tab = CreateTestWebContents();
+  RenderFrameHost* const other_rfh = other_tab->GetPrimaryMainFrame();
+  RenderFrameHostTester::For(other_rfh)->InitializeRenderFrameIfNeeded();
+
   host_ = std::make_unique<MockMediaStreamDispatcherHost>(
-      GlobalRenderFrameHostId{kRenderFrameHostId.child_id,
-                              kRenderFrameHostId.frame_routing_id + 1},
-      media_stream_manager_.get());
+      other_rfh->GetGlobalId(), media_stream_manager_.get());
   host_->set_get_salt_and_origin_cb_for_testing(
       base::BindRepeating(&MediaStreamDispatcherHostTest::GetSaltAndOrigin,
                           base::Unretained(this)));
@@ -844,11 +874,9 @@
                           base::Unretained(this)));
 
   base::RunLoop run_loop;
-  EXPECT_CALL(
-      *host_,
-      OnStreamGenerationFailure(
-          kPageRequestId,
-          blink::mojom::MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN));
+  EXPECT_CALL(*host_, OnStreamGenerationFailure(
+                          kPageRequestId,
+                          MediaStreamRequestResult::FAILED_DUE_TO_SHUTDOWN));
   host_->OnGenerateStreams(kPageRequestId, controls, run_loop.QuitClosure());
   run_loop.RunUntilIdle();
 }
@@ -1004,9 +1032,8 @@
   blink::StreamControls controls(true, true);
   controls.video.device_ids = {"invalid source id"};
 
-  GenerateStreamAndWaitForFailure(
-      kPageRequestId, controls,
-      blink::mojom::MediaStreamRequestResult::NO_HARDWARE);
+  GenerateStreamAndWaitForFailure(kPageRequestId, controls,
+                                  MediaStreamRequestResult::NO_HARDWARE);
 }
 
 // Test that generating a stream with an invalid audio source id fail.
@@ -1014,9 +1041,8 @@
   blink::StreamControls controls(true, true);
   controls.audio.device_ids = {"invalid source id"};
 
-  GenerateStreamAndWaitForFailure(
-      kPageRequestId, controls,
-      blink::mojom::MediaStreamRequestResult::NO_HARDWARE);
+  GenerateStreamAndWaitForFailure(kPageRequestId, controls,
+                                  MediaStreamRequestResult::NO_HARDWARE);
 }
 
 TEST_F(MediaStreamDispatcherHostTest, GenerateStreamsNoAvailableVideoDevice) {
@@ -1024,9 +1050,8 @@
   blink::StreamControls controls(true, true);
 
   SetupFakeUI(false);
-  GenerateStreamAndWaitForFailure(
-      kPageRequestId, controls,
-      blink::mojom::MediaStreamRequestResult::NO_HARDWARE);
+  GenerateStreamAndWaitForFailure(kPageRequestId, controls,
+                                  MediaStreamRequestResult::NO_HARDWARE);
 }
 
 // Test that if a OnStopStreamDevice message is received for a device that has
@@ -1148,7 +1173,8 @@
                              run_loop.QuitClosure());
   }
 
-  media_stream_manager_->CancelAllRequests(kRenderFrameHostId, kRequesterId);
+  media_stream_manager_->CancelAllRequests(main_rfh()->GetGlobalId(),
+                                           kRequesterId);
   run_loop.RunUntilIdle();
 }
 
@@ -1167,7 +1193,8 @@
... (truncated)

Loading diff…

References

Vendor advisory Fix commit Bug tracker NVD

On This Page