[Backport] Security bug 960785

Make AvailabilityState garbage collected.

Due to lifecycle issues with the presentation API it is easier to
ensure that the objects it creates are garbage collected and we can
copy the lists before iterating on them.

BUG=960785

Change-Id: I06fe61d0465fa36e16a3defa7b06a32b220b05c4
Commit-Queue: Dave Tapuska <dtapuska@chromium.org>
Reviewed-by: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#666443}
Reviewed-by: Michal Klocek <michal.klocek@qt.io>

9 files changed, 172 insertions, 144 deletions

diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.cc b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.cc
index 437194d7e6d..0133032af03 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.cc
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.cc
@@ -48,4 +48,8 @@ void PresentationAvailabilityCallbacks::RejectAvailabilityNotSupported() {
   resolver_->Reject(CreateAvailabilityNotSupportedError());
 }
 
+void PresentationAvailabilityCallbacks::Trace(blink::Visitor* visitor) {
+  visitor->Trace(resolver_);
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.h b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.h
index df122fb3e1b..54565ad5ce6 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.h
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_callbacks.h
@@ -19,7 +19,8 @@ namespace blink {
 // depending on the availability result.
 // TODO(crbug.com/749327): Consider removing this class and have
 // PresentationAvailabilityState use PresentationAvailabilityProperty directly.
-class MODULES_EXPORT PresentationAvailabilityCallbacks {
+class MODULES_EXPORT PresentationAvailabilityCallbacks
+    : public GarbageCollectedFinalized<PresentationAvailabilityCallbacks> {
  public:
   PresentationAvailabilityCallbacks(PresentationAvailabilityProperty*,
                                     const WTF::Vector<KURL>&);
@@ -28,8 +29,10 @@ class MODULES_EXPORT PresentationAvailabilityCallbacks {
   virtual void Resolve(bool value);
   virtual void RejectAvailabilityNotSupported();
 
+  void Trace(blink::Visitor*);
+
  private:
-  Persistent<PresentationAvailabilityProperty> resolver_;
+  Member<PresentationAvailabilityProperty> resolver_;
   const WTF::Vector<KURL> urls_;
 
   WTF_MAKE_NONCOPYABLE(PresentationAvailabilityCallbacks);
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_observer.h b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_observer.h
index 9d6cda36820..efd42039f73 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_observer.h
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_observer.h
@@ -6,6 +6,7 @@
 #define THIRD_PARTY_BLINK_RENDERER_MODULES_PRESENTATION_PRESENTATION_AVAILABILITY_OBSERVER_H_
 
 #include "third_party/blink/public/mojom/presentation/presentation.mojom-blink.h"
+#include "third_party/blink/renderer/platform/heap/garbage_collected.h"
 #include "third_party/blink/renderer/platform/wtf/vector.h"
 
 namespace blink {
@@ -15,7 +16,7 @@ class KURL;
 // PresentationAvailabilityObserver is an interface that is implemented by
 // objects that wish to be notified when there is a presentation display
 // availability change for given URLs.
-class PresentationAvailabilityObserver {
+class PresentationAvailabilityObserver : public GarbageCollectedMixin {
  public:
   virtual ~PresentationAvailabilityObserver() = default;
 
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.cc b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.cc
index f40385eaf6d..e78fd2e0de8 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.cc
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.cc
@@ -7,6 +7,7 @@
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/modules/presentation/presentation_availability_observer.h"
 #include "third_party/blink/renderer/modules/presentation/presentation_controller.h"
+#include "third_party/blink/renderer/platform/heap/persistent.h"
 #include "third_party/blink/renderer/platform/scheduler/public/thread.h"
 #include "third_party/blink/renderer/platform/wtf/functional.h"
 
@@ -20,7 +21,7 @@ PresentationAvailabilityState::~PresentationAvailabilityState() = default;
 
 void PresentationAvailabilityState::RequestAvailability(
     const Vector<KURL>& urls,
-    std::unique_ptr<PresentationAvailabilityCallbacks> callback) {
+    PresentationAvailabilityCallbacks* callback) {
   auto screen_availability = GetScreenAvailability(urls);
   // Reject Promise if screen availability is unsupported for all URLs.
   if (screen_availability == mojom::blink::ScreenAvailability::DISABLED) {
@@ -28,25 +29,25 @@ void PresentationAvailabilityState::RequestAvailability(
         FROM_HERE,
         WTF::Bind(
             &PresentationAvailabilityCallbacks::RejectAvailabilityNotSupported,
-            std::move(callback)));
+            WrapPersistent(callback)));
     // Do not listen to urls if we reject the promise.
     return;
   }
 
   auto* listener = GetAvailabilityListener(urls);
   if (!listener) {
-    listener = new AvailabilityListener(urls);
+    listener = MakeGarbageCollected<AvailabilityListener>(urls);
     availability_listeners_.emplace_back(listener);
   }
 
   if (screen_availability != mojom::blink::ScreenAvailability::UNKNOWN) {
     Thread::Current()->GetTaskRunner()->PostTask(
         FROM_HERE, WTF::Bind(&PresentationAvailabilityCallbacks::Resolve,
-                             std::move(callback),
+                             WrapPersistent(callback),
                              screen_availability ==
                                  mojom::blink::ScreenAvailability::AVAILABLE));
   } else {
-    listener->availability_callbacks.push_back(std::move(callback));
+    listener->availability_callbacks.push_back(callback);
   }
 
   for (const auto& availability_url : urls)
@@ -58,11 +59,13 @@ void PresentationAvailabilityState::AddObserver(
   const auto& urls = observer->Urls();
   auto* listener = GetAvailabilityListener(urls);
   if (!listener) {
-    listener = new AvailabilityListener(urls);
+    listener = MakeGarbageCollected<AvailabilityListener>(urls);
     availability_listeners_.emplace_back(listener);
   }
 
-  listener->availability_observers.insert(observer);
+  if (listener->availability_observers.Contains(observer))
+    return;
+  listener->availability_observers.push_back(observer);
   for (const auto& availability_url : urls)
     StartListeningToURL(availability_url);
 }
@@ -76,7 +79,10 @@ void PresentationAvailabilityState::RemoveObserver(
     return;
   }
 
-  listener->availability_observers.erase(observer);
+  wtf_size_t slot = listener->availability_observers.Find(observer);
+  if (slot != kNotFound) {
+    listener->availability_observers.EraseAt(slot);
+  }
   for (const auto& availability_url : urls)
     MaybeStopListeningToURL(availability_url);
 
@@ -98,42 +104,40 @@ void PresentationAvailabilityState::UpdateAvailability(
 
   listening_status->last_known_availability = availability;
 
-  std::vector<AvailabilityListener*> modified_listeners;
-  {
-    // Set |iterating_listeners_| so we know not to allow modifications
-    // to |availability_listeners_|.
-    base::AutoReset<bool> iterating(&iterating_listeners_, true);
-    for (auto& listener_ref : availability_listeners_) {
-      auto* listener = listener_ref.get();
-      if (!listener->urls.Contains<KURL>(url))
-        continue;
-
-      auto screen_availability = GetScreenAvailability(listener->urls);
-      DCHECK(screen_availability != mojom::blink::ScreenAvailability::UNKNOWN);
-      for (auto* observer : listener->availability_observers)
-        observer->AvailabilityChanged(screen_availability);
-
-      if (screen_availability == mojom::blink::ScreenAvailability::DISABLED) {
-        for (auto& callback_ptr : listener->availability_callbacks) {
-          callback_ptr->RejectAvailabilityNotSupported();
-        }
-      } else {
-        for (auto& callback_ptr : listener->availability_callbacks) {
-          callback_ptr->Resolve(screen_availability ==
-                                mojom::blink::ScreenAvailability::AVAILABLE);
-        }
-      }
-      listener->availability_callbacks.clear();
+  HeapVector<Member<AvailabilityListener>> listeners = availability_listeners_;
+  for (auto& listener : listeners) {
+    if (!listener->urls.Contains<KURL>(url))
+      continue;
 
-      for (const auto& availability_url : listener->urls)
-        MaybeStopListeningToURL(availability_url);
+    auto screen_availability = GetScreenAvailability(listener->urls);
+    DCHECK(screen_availability != mojom::blink::ScreenAvailability::UNKNOWN);
+    HeapVector<Member<PresentationAvailabilityObserver>> observers =
+        listener->availability_observers;
+    for (auto& observer : observers) {
+      observer->AvailabilityChanged(screen_availability);
+    }
 
-      modified_listeners.push_back(listener);
+    if (screen_availability == mojom::blink::ScreenAvailability::DISABLED) {
+      for (auto& callback_ptr : listener->availability_callbacks) {
+        callback_ptr->RejectAvailabilityNotSupported();
+      }
+    } else {
+      for (auto& callback_ptr : listener->availability_callbacks) {
+        callback_ptr->Resolve(screen_availability ==
+                              mojom::blink::ScreenAvailability::AVAILABLE);
+      }
     }
-  }
+    listener->availability_callbacks.clear();
+
+    for (const auto& availability_url : listener->urls)
+      MaybeStopListeningToURL(availability_url);
 
-  for (auto* listener : modified_listeners)
     TryRemoveAvailabilityListener(listener);
+  }
+}
+
+void PresentationAvailabilityState::Trace(blink::Visitor* visitor) {
+  visitor->Trace(availability_listeners_);
 }
 
 void PresentationAvailabilityState::StartListeningToURL(const KURL& url) {
@@ -157,8 +161,8 @@ void PresentationAvailabilityState::MaybeStopListeningToURL(const KURL& url) {
       continue;
 
     // URL is still observed by some availability object.
-    if (!listener->availability_callbacks.empty() ||
-        !listener->availability_observers.empty()) {
+    if (!listener->availability_callbacks.IsEmpty() ||
+        !listener->availability_observers.IsEmpty()) {
       return;
     }
   }
@@ -216,34 +220,24 @@ PresentationAvailabilityState::GetScreenAvailability(
 
 PresentationAvailabilityState::AvailabilityListener*
 PresentationAvailabilityState::GetAvailabilityListener(
-    const Vector<KURL>& urls) const {
-  auto listener_it = std::find_if(
+    const Vector<KURL>& urls) {
+  auto* listener_it = std::find_if(
       availability_listeners_.begin(), availability_listeners_.end(),
-      [&urls](const std::unique_ptr<AvailabilityListener>& x) {
-        return x->urls == urls;
-      });
-  return listener_it == availability_listeners_.end() ? nullptr
-                                                      : listener_it->get();
+      [&urls](const auto& listener) { return listener->urls == urls; });
+  return listener_it == availability_listeners_.end() ? nullptr : *listener_it;
 }
 
 void PresentationAvailabilityState::TryRemoveAvailabilityListener(
     AvailabilityListener* listener) {
-  if (iterating_listeners_)
-    return;
-
   // URL is still observed by some availability object.
-  if (!listener->availability_callbacks.empty() ||
-      !listener->availability_observers.empty()) {
+  if (!listener->availability_callbacks.IsEmpty() ||
+      !listener->availability_observers.IsEmpty()) {
     return;
   }
 
-  auto listener_it = availability_listeners_.begin();
-  while (listener_it != availability_listeners_.end()) {
-    if (listener_it->get() == listener) {
-      availability_listeners_.erase(listener_it);
-      return;
-    }
-    ++listener_it;
+  wtf_size_t slot = availability_listeners_.Find(listener);
+  if (slot != kNotFound) {
+    availability_listeners_.EraseAt(slot);
   }
 }
 
@@ -266,6 +260,12 @@ PresentationAvailabilityState::AvailabilityListener::AvailabilityListener(
 PresentationAvailabilityState::AvailabilityListener::~AvailabilityListener() =
     default;
 
+void PresentationAvailabilityState::AvailabilityListener::Trace(
+    blink::Visitor* visitor) {
+  visitor->Trace(availability_callbacks);
+  visitor->Trace(availability_observers);
+}
+
 PresentationAvailabilityState::ListeningStatus::ListeningStatus(
     const KURL& availability_url)
     : url(availability_url),
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.h b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.h
index 4195474b3dd..13dd5b8d808 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.h
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state.h
@@ -29,7 +29,8 @@ class PresentationAvailabilityObserver;
 // TODO(crbug.com/780109): Improve encapsulation of PresentationAvailability and
 // this class by moving the multiple URL tracking logic to the former, and
 // consolidating this class's APIs to take repeating callbacks.
-class MODULES_EXPORT PresentationAvailabilityState {
+class MODULES_EXPORT PresentationAvailabilityState
+    : public GarbageCollectedFinalized<PresentationAvailabilityState> {
  public:
   explicit PresentationAvailabilityState(mojom::blink::PresentationService*);
   ~PresentationAvailabilityState();
@@ -38,7 +39,7 @@ class MODULES_EXPORT PresentationAvailabilityState {
   // with the determined availability value. The callbacks will only be invoked
   // once and will be deleted afterwards.
   void RequestAvailability(const Vector<KURL>&,
-                           std::unique_ptr<PresentationAvailabilityCallbacks>);
+                           PresentationAvailabilityCallbacks* callbacks);
 
   // Starts/stops listening for availability with the given observer.
   void AddObserver(PresentationAvailabilityObserver*);
@@ -48,6 +49,8 @@ class MODULES_EXPORT PresentationAvailabilityState {
   // callbacks and observers.
   void UpdateAvailability(const KURL&, mojom::blink::ScreenAvailability);
 
+  void Trace(blink::Visitor*);
+
  private:
   enum class ListeningState {
     INACTIVE,
@@ -58,15 +61,20 @@ class MODULES_EXPORT PresentationAvailabilityState {
   // Tracks listeners of presentation displays availability for
   // |availability_urls|. Shared with PresentationRequest objects with the same
   // set of URLs.
-  struct AvailabilityListener {
+  class AvailabilityListener
+      : public GarbageCollectedFinalized<AvailabilityListener> {
+   public:
     explicit AvailabilityListener(const Vector<KURL>& availability_urls);
     ~AvailabilityListener();
 
     const Vector<KURL> urls;
-    std::vector<std::unique_ptr<PresentationAvailabilityCallbacks>>
+    HeapVector<Member<PresentationAvailabilityCallbacks>>
         availability_callbacks;
-    std::set<PresentationAvailabilityObserver*> availability_observers;
+    HeapVector<Member<PresentationAvailabilityObserver>> availability_observers;
+
+    void Trace(blink::Visitor*);
 
+   private:
     DISALLOW_COPY_AND_ASSIGN(AvailabilityListener);
   };
 
@@ -101,7 +109,7 @@ class MODULES_EXPORT PresentationAvailabilityState {
       const Vector<KURL>&) const;
 
   // Returns nullptr if there is no AvailabilityListener for the given URLs.
-  AvailabilityListener* GetAvailabilityListener(const Vector<KURL>&) const;
+  AvailabilityListener* GetAvailabilityListener(const Vector<KURL>&);
 
   // Removes the given listener from |availability_set_| if it has no callbacks
   // and no observers.
@@ -114,15 +122,11 @@ class MODULES_EXPORT PresentationAvailabilityState {
   std::vector<std::unique_ptr<ListeningStatus>> availability_listening_status_;
 
   // Set of AvailabilityListener for known PresentationRequests.
-  std::vector<std::unique_ptr<AvailabilityListener>> availability_listeners_;
+  HeapVector<Member<AvailabilityListener>> availability_listeners_;
 
   // A pointer to PresentationService owned by PresentationController.
   mojom::blink::PresentationService* const presentation_service_;
 
-  // Whether we are iterating listeners, if this state is set we avoid
-  // removing items from |availability_listeners_|.
-  bool iterating_listeners_ = false;
-
   DISALLOW_COPY_AND_ASSIGN(PresentationAvailabilityState);
 };
 
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state_test.cc b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state_test.cc
index a828aa58912..ea5e2eb25cc 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state_test.cc
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_availability_state_test.cc
@@ -21,7 +21,10 @@ namespace blink {
 using mojom::blink::ScreenAvailability;
 
 class MockPresentationAvailabilityObserver
-    : public PresentationAvailabilityObserver {
+    : public GarbageCollectedFinalized<MockPresentationAvailabilityObserver>,
+      public PresentationAvailabilityObserver {
+  USING_GARBAGE_COLLECTED_MIXIN(MockPresentationAvailabilityObserver);
+
  public:
   explicit MockPresentationAvailabilityObserver(const Vector<KURL>& urls)
       : urls_(urls) {}
@@ -53,27 +56,35 @@ class PresentationAvailabilityStateTest : public testing::Test {
         url3_(KURL("https://www.example.com/3.html")),
         url4_(KURL("https://www.example.com/4.html")),
         urls_({url1_, url2_, url3_, url4_}),
-        mock_observer_all_urls_(urls_),
-        mock_observer1_({url1_, url2_, url3_}),
-        mock_observer2_({url2_, url3_, url4_}),
-        mock_observer3_({url2_, url3_}),
-        mock_observers_({&mock_observer1_, &mock_observer2_, &mock_observer3_}),
+        mock_observer_all_urls_(
+            MakeGarbageCollected<MockPresentationAvailabilityObserver>(urls_)),
+        mock_observer1_(
+            MakeGarbageCollected<MockPresentationAvailabilityObserver>(
+                Vector<KURL>({url1_, url2_, url3_}))),
+        mock_observer2_(
+            MakeGarbageCollected<MockPresentationAvailabilityObserver>(
+                Vector<KURL>({url2_, url3_, url4_}))),
+        mock_observer3_(
+            MakeGarbageCollected<MockPresentationAvailabilityObserver>(
+                Vector<KURL>({url2_, url3_}))),
+        mock_observers_({mock_observer1_, mock_observer2_, mock_observer3_}),
         mock_presentation_service_(),
-        state_(&mock_presentation_service_) {}
+        state_(MakeGarbageCollected<PresentationAvailabilityState>(
+            &mock_presentation_service_)) {}
 
   ~PresentationAvailabilityStateTest() override = default;
 
   void ChangeURLState(const KURL& url, ScreenAvailability state) {
     if (state != ScreenAvailability::UNKNOWN)
-      state_.UpdateAvailability(url, state);
+      state_->UpdateAvailability(url, state);
   }
 
   void RequestAvailabilityAndAddObservers() {
     for (auto* mock_observer : mock_observers_) {
-      state_.RequestAvailability(
+      state_->RequestAvailability(
           mock_observer->Urls(),
-          std::make_unique<MockPresentationAvailabilityCallbacks>());
-      state_.AddObserver(mock_observer);
+          MakeGarbageCollected<MockPresentationAvailabilityCallbacks>());
+      state_->AddObserver(mock_observer);
     }
   }
 
@@ -94,9 +105,7 @@ class PresentationAvailabilityStateTest : public testing::Test {
           .Times(1);
     }
 
-    state_.RequestAvailability(
-        urls,
-        std::unique_ptr<MockPresentationAvailabilityCallbacks>(mock_callback));
+    state_->RequestAvailability(urls, mock_callback);
     for (wtf_size_t i = 0; i < urls.size(); i++)
       ChangeURLState(urls[i], states[i]);
   }
@@ -107,14 +116,14 @@ class PresentationAvailabilityStateTest : public testing::Test {
   const KURL url3_;
   const KURL url4_;
   const Vector<KURL> urls_;
-  MockPresentationAvailabilityObserver mock_observer_all_urls_;
-  MockPresentationAvailabilityObserver mock_observer1_;
-  MockPresentationAvailabilityObserver mock_observer2_;
-  MockPresentationAvailabilityObserver mock_observer3_;
+  Persistent<MockPresentationAvailabilityObserver> mock_observer_all_urls_;
+  Persistent<MockPresentationAvailabilityObserver> mock_observer1_;
+  Persistent<MockPresentationAvailabilityObserver> mock_observer2_;
+  Persistent<MockPresentationAvailabilityObserver> mock_observer3_;
   std::vector<MockPresentationAvailabilityObserver*> mock_observers_;
 
   MockPresentationService mock_presentation_service_;
-  PresentationAvailabilityState state_;
+  Persistent<PresentationAvailabilityState> state_;
 };
 
 TEST_F(PresentationAvailabilityStateTest, RequestAvailability) {
@@ -124,33 +133,33 @@ TEST_F(PresentationAvailabilityStateTest, RequestAvailability) {
                 StopListeningForScreenAvailability(url));
   }
 
-  state_.RequestAvailability(
-      urls_, std::make_unique<MockPresentationAvailabilityCallbacks>());
-  state_.UpdateAvailability(url1_, ScreenAvailability::AVAILABLE);
+  state_->RequestAvailability(
+      urls_, MakeGarbageCollected<MockPresentationAvailabilityCallbacks>());
+  state_->UpdateAvailability(url1_, ScreenAvailability::AVAILABLE);
 
   for (const auto& url : urls_)
     EXPECT_CALL(mock_presentation_service_, ListenForScreenAvailability(url));
 
-  state_.AddObserver(&mock_observer_all_urls_);
+  state_->AddObserver(mock_observer_all_urls_);
 
-  EXPECT_CALL(mock_observer_all_urls_,
+  EXPECT_CALL(*mock_observer_all_urls_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
-  state_.UpdateAvailability(url1_, ScreenAvailability::UNAVAILABLE);
-  EXPECT_CALL(mock_observer_all_urls_,
+  state_->UpdateAvailability(url1_, ScreenAvailability::UNAVAILABLE);
+  EXPECT_CALL(*mock_observer_all_urls_,
               AvailabilityChanged(ScreenAvailability::AVAILABLE));
-  state_.UpdateAvailability(url1_, ScreenAvailability::AVAILABLE);
+  state_->UpdateAvailability(url1_, ScreenAvailability::AVAILABLE);
   for (const auto& url : urls_) {
     EXPECT_CALL(mock_presentation_service_,
                 StopListeningForScreenAvailability(url));
   }
-  state_.RemoveObserver(&mock_observer_all_urls_);
+  state_->RemoveObserver(mock_observer_all_urls_);
 
   // After RemoveObserver(), |mock_observer_all_urls_| should no longer be
   // notified.
-  EXPECT_CALL(mock_observer_all_urls_,
+  EXPECT_CALL(*mock_observer_all_urls_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE))
       .Times(0);
-  state_.UpdateAvailability(url1_, ScreenAvailability::UNAVAILABLE);
+  state_->UpdateAvailability(url1_, ScreenAvailability::UNAVAILABLE);
 }
 
 TEST_F(PresentationAvailabilityStateTest,
@@ -158,35 +167,34 @@ TEST_F(PresentationAvailabilityStateTest,
   for (const auto& url : urls_)
     EXPECT_CALL(mock_presentation_service_, ListenForScreenAvailability(url));
 
-  state_.AddObserver(&mock_observer_all_urls_);
+  state_->AddObserver(mock_observer_all_urls_);
 
-  EXPECT_CALL(mock_observer_all_urls_,
+  EXPECT_CALL(*mock_observer_all_urls_,
               AvailabilityChanged(ScreenAvailability::SOURCE_NOT_SUPPORTED));
-  state_.UpdateAvailability(url1_, ScreenAvailability::SOURCE_NOT_SUPPORTED);
+  state_->UpdateAvailability(url1_, ScreenAvailability::SOURCE_NOT_SUPPORTED);
 
   for (const auto& url : urls_) {
     EXPECT_CALL(mock_presentation_service_,
                 StopListeningForScreenAvailability(url));
   }
-  state_.RemoveObserver(&mock_observer_all_urls_);
+  state_->RemoveObserver(mock_observer_all_urls_);
 }
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityOneUrlNoAvailabilityChange) {
-  auto* mock_callback =
-      new testing::StrictMock<MockPresentationAvailabilityCallbacks>();
+  auto* mock_callback = MakeGarbageCollected<
+      testing::StrictMock<MockPresentationAvailabilityCallbacks>>();
 
   EXPECT_CALL(mock_presentation_service_, ListenForScreenAvailability(url1_))
       .Times(1);
 
-  state_.RequestAvailability(
-      Vector<KURL>({url1_}),
-      std::unique_ptr<PresentationAvailabilityCallbacks>(mock_callback));
+  state_->RequestAvailability(Vector<KURL>({url1_}), mock_callback);
 }
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityOneUrlBecomesAvailable) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(true));
 
   TestRequestAvailability({url1_}, {ScreenAvailability::AVAILABLE},
@@ -195,7 +203,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityOneUrlBecomesNotCompatible) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(false));
 
   TestRequestAvailability({url1_}, {ScreenAvailability::SOURCE_NOT_SUPPORTED},
@@ -204,7 +213,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityOneUrlBecomesUnavailable) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(false));
 
   TestRequestAvailability({url1_}, {ScreenAvailability::UNAVAILABLE},
@@ -213,7 +223,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityOneUrlBecomesUnsupported) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, RejectAvailabilityNotSupported());
 
   TestRequestAvailability({url1_}, {ScreenAvailability::DISABLED},
@@ -222,7 +233,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityMultipleUrlsAllBecomesAvailable) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(true)).Times(1);
 
   TestRequestAvailability(
@@ -233,7 +245,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityMultipleUrlsAllBecomesUnavailable) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(false)).Times(1);
 
   TestRequestAvailability(
@@ -244,7 +257,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityMultipleUrlsAllBecomesNotCompatible) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, Resolve(false)).Times(1);
 
   TestRequestAvailability({url1_, url2_},
@@ -255,7 +269,8 @@ TEST_F(PresentationAvailabilityStateTest,
 
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityMultipleUrlsAllBecomesUnsupported) {
-  auto* mock_callback = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback, RejectAvailabilityNotSupported()).Times(1);
 
   TestRequestAvailability(
@@ -267,7 +282,8 @@ TEST_F(PresentationAvailabilityStateTest,
 TEST_F(PresentationAvailabilityStateTest,
        RequestAvailabilityReturnsDirectlyForAlreadyListeningUrls) {
   // First getAvailability() call.
-  auto* mock_callback_1 = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback_1 =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback_1, Resolve(false)).Times(1);
 
   std::vector<ScreenAvailability> state_seq = {ScreenAvailability::UNAVAILABLE,
@@ -276,16 +292,15 @@ TEST_F(PresentationAvailabilityStateTest,
   TestRequestAvailability({url1_, url2_, url3_}, state_seq, mock_callback_1);
 
   // Second getAvailability() call.
-  for (const auto& url : mock_observer3_.Urls()) {
+  for (const auto& url : mock_observer3_->Urls()) {
     EXPECT_CALL(mock_presentation_service_, ListenForScreenAvailability(url))
         .Times(1);
   }
-  auto* mock_callback_2 = new MockPresentationAvailabilityCallbacks();
+  auto* mock_callback_2 =
+      MakeGarbageCollected<MockPresentationAvailabilityCallbacks>();
   EXPECT_CALL(*mock_callback_2, Resolve(true)).Times(1);
 
-  state_.RequestAvailability(
-      mock_observer3_.Urls(),
-      std::unique_ptr<MockPresentationAvailabilityCallbacks>(mock_callback_2));
+  state_->RequestAvailability(mock_observer3_->Urls(), mock_callback_2);
 }
 
 TEST_F(PresentationAvailabilityStateTest, StartListeningListenToEachURLOnce) {
@@ -306,11 +321,11 @@ TEST_F(PresentationAvailabilityStateTest, StopListeningListenToEachURLOnce) {
         .Times(1);
   }
 
-  EXPECT_CALL(mock_observer1_,
+  EXPECT_CALL(*mock_observer1_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
-  EXPECT_CALL(mock_observer2_,
+  EXPECT_CALL(*mock_observer2_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
-  EXPECT_CALL(mock_observer3_,
+  EXPECT_CALL(*mock_observer3_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
 
   RequestAvailabilityAndAddObservers();
@@ -319,7 +334,7 @@ TEST_F(PresentationAvailabilityStateTest, StopListeningListenToEachURLOnce) {
   ChangeURLState(url2_, ScreenAvailability::UNAVAILABLE);
 
   for (auto* mock_observer : mock_observers_)
-    state_.RemoveObserver(mock_observer);
+    state_->RemoveObserver(mock_observer);
 }
 
 TEST_F(PresentationAvailabilityStateTest,
@@ -343,18 +358,18 @@ TEST_F(PresentationAvailabilityStateTest,
   RequestAvailabilityAndAddObservers();
 
   for (auto* mock_observer : mock_observers_)
-    state_.AddObserver(mock_observer);
+    state_->AddObserver(mock_observer);
 
-  EXPECT_CALL(mock_observer1_,
+  EXPECT_CALL(*mock_observer1_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
-  EXPECT_CALL(mock_observer2_,
+  EXPECT_CALL(*mock_observer2_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
-  EXPECT_CALL(mock_observer3_,
+  EXPECT_CALL(*mock_observer3_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
 
   // Clean up callbacks.
   ChangeURLState(url2_, ScreenAvailability::UNAVAILABLE);
-  state_.RemoveObserver(&mock_observer1_);
+  state_->RemoveObserver(mock_observer1_);
 }
 
 TEST_F(PresentationAvailabilityStateTest,
@@ -364,18 +379,18 @@ TEST_F(PresentationAvailabilityStateTest,
         .Times(1);
   }
 
-  EXPECT_CALL(mock_observer1_,
+  EXPECT_CALL(*mock_observer1_,
               AvailabilityChanged(ScreenAvailability::AVAILABLE));
 
   RequestAvailabilityAndAddObservers();
 
   ChangeURLState(url1_, ScreenAvailability::AVAILABLE);
 
-  EXPECT_CALL(mock_observer1_,
+  EXPECT_CALL(*mock_observer1_,
               AvailabilityChanged(ScreenAvailability::UNAVAILABLE));
   ChangeURLState(url1_, ScreenAvailability::UNAVAILABLE);
 
-  EXPECT_CALL(mock_observer1_,
+  EXPECT_CALL(*mock_observer1_,
               AvailabilityChanged(ScreenAvailability::SOURCE_NOT_SUPPORTED));
   ChangeURLState(url1_, ScreenAvailability::SOURCE_NOT_SUPPORTED);
 }
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.cc b/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.cc
index cfcda230e7e..c8c27ec7d04 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.cc
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.cc
@@ -55,6 +55,7 @@ PresentationController* PresentationController::FromContext(
 void PresentationController::Trace(blink::Visitor* visitor) {
   visitor->Trace(presentation_);
   visitor->Trace(connections_);
+  visitor->Trace(availability_state_);
   Supplement<LocalFrame>::Trace(visitor);
   ContextLifecycleObserver::Trace(visitor);
 }
@@ -70,11 +71,11 @@ void PresentationController::RegisterConnection(
 
 PresentationAvailabilityState* PresentationController::GetAvailabilityState() {
   if (!availability_state_) {
-    availability_state_.reset(
-        new PresentationAvailabilityState(GetPresentationService().get()));
+    availability_state_ = MakeGarbageCollected<PresentationAvailabilityState>(
+        GetPresentationService().get());
   }
 
-  return availability_state_.get();
+  return availability_state_;
 }
 
 void PresentationController::AddAvailabilityObserver(
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.h b/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.h
index 2d7a4b010ca..c232c34c1a4 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.h
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_controller.h
@@ -100,7 +100,7 @@ class MODULES_EXPORT PresentationController
       const mojom::blink::PresentationInfo&) const;
 
   // Lazily-instantiated when the page queries for availability.
-  std::unique_ptr<PresentationAvailabilityState> availability_state_;
+  Member<PresentationAvailabilityState> availability_state_;
 
   // The Presentation instance associated with that frame.
   WeakMember<Presentation> presentation_;
diff --git a/chromium/third_party/blink/renderer/modules/presentation/presentation_request.cc b/chromium/third_party/blink/renderer/modules/presentation/presentation_request.cc
index 7d5c646ba8b..46bc7bcf9cc 100644
--- a/chromium/third_party/blink/renderer/modules/presentation/presentation_request.cc
+++ b/chromium/third_party/blink/renderer/modules/presentation/presentation_request.cc
@@ -216,7 +216,7 @@ ScriptPromise PresentationRequest::getAvailability(ScriptState* script_state) {
             PresentationAvailabilityProperty::kReady);
 
     controller->GetAvailabilityState()->RequestAvailability(
-        urls_, std::make_unique<PresentationAvailabilityCallbacks>(
+        urls_, MakeGarbageCollected<PresentationAvailabilityCallbacks>(
                    availability_property_, urls_));
   }
   return availability_property_->Promise(script_state->World());