[Backport] Security bug 1372019 (1/4)

Manual cherry-pick of patch originally reviewed on
https://chromium-review.googlesource.com/c/chromium/src/+/3609036:
Remove GpuMemoryBufferFactory usages from platform_video_frame_utils.*.

  media/gpu/chromeos/platform_video_frame_utils.cc:
    CreateGpuMemoryBufferVideoFrame():
      The original CL doesn't have the frame check that is present in 102

  media/mojo/services/gpu_mojo_media_client_cros.cc:
    102 passes traits.gpu_memory_buffer_factory to PlatformVideoFramePool instead
    of null. Kept the change removing the parameter.

  media/mojo/services/stable_video_decoder_factory_service.cc:
    changed code isn't present in 102, skipped

After CL:3597211, we no longer use the GpuMemoryBufferFactory paths in
platform_video_frame_utils.{cc,h} in non-test code. Therefore, we should
be able to remove a lot of code there and in places where a
GpuMemoryBufferFactory is plumbed through. This CL does that.

No functional changes intended in non-test code.

Bug: b:230370976
Test: video.DecodeAccelVD.h264_resolution_switch on volteer
Test: video.DecodeAccelVDPerf.h264_1080p_60fps on volteer
Test: video.DecodeAccel.h264_resolution_switch on volteer
Test: video.DecodeAccelPerf.h264_1080p_60fps on volteer
Test: video.EncodeAccel.h264_1080p on volteer
Change-Id: I1c35f49fe88b5e5777e15c649662c436f25b9806
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3609036
Commit-Queue: Andres Calderon Jaramillo <andrescj@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1003830}
(cherry picked from commit 101402b62c1190fc5e0aa88c4e7432b98ed8d521)
Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/447832
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

10 files changed, 53 insertions, 130 deletions

diff --git a/chromium/media/gpu/chromeos/dmabuf_video_frame_pool.h b/chromium/media/gpu/chromeos/dmabuf_video_frame_pool.h
index 87840b21c85..74b0b79e770 100644
--- a/chromium/media/gpu/chromeos/dmabuf_video_frame_pool.h
+++ b/chromium/media/gpu/chromeos/dmabuf_video_frame_pool.h
@@ -18,10 +18,6 @@
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/size.h"
 
-namespace gpu {
-class GpuMemoryBufferFactory;
-}  // namespace gpu
-
 namespace media {
 
 // Forward declare for use in AsPlatformVideoFramePool.
@@ -38,7 +34,6 @@ class MEDIA_GPU_EXPORT DmabufVideoFramePool {
 
   using CreateFrameCB =
       base::RepeatingCallback<CroStatus::Or<scoped_refptr<VideoFrame>>(
-          gpu::GpuMemoryBufferFactory*,
           VideoPixelFormat,
           const gfx::Size&,
           const gfx::Rect&,
diff --git a/chromium/media/gpu/chromeos/platform_video_frame_pool.cc b/chromium/media/gpu/chromeos/platform_video_frame_pool.cc
index 019bf5a82a0..1f077cdaf67 100644
--- a/chromium/media/gpu/chromeos/platform_video_frame_pool.cc
+++ b/chromium/media/gpu/chromeos/platform_video_frame_pool.cc
@@ -20,7 +20,6 @@ namespace {
 
 // The default method to create frames.
 CroStatus::Or<scoped_refptr<VideoFrame>> DefaultCreateFrame(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
@@ -34,8 +33,7 @@ CroStatus::Or<scoped_refptr<VideoFrame>> DefaultCreateFrame(
   }
 
   scoped_refptr<VideoFrame> frame = CreateGpuMemoryBufferVideoFrame(
-      gpu_memory_buffer_factory, format, coded_size, visible_rect, natural_size,
-      timestamp,
+      format, coded_size, visible_rect, natural_size, timestamp,
       use_protected
           ? gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE
           : (use_linear_buffers ? gfx::BufferUsage::SCANOUT_CPU_READ_WRITE
@@ -54,10 +52,8 @@ CroStatus::Or<scoped_refptr<VideoFrame>> DefaultCreateFrame(
 
 }  // namespace
 
-PlatformVideoFramePool::PlatformVideoFramePool(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory)
-    : create_frame_cb_(base::BindRepeating(&DefaultCreateFrame)),
-      gpu_memory_buffer_factory_(gpu_memory_buffer_factory) {
+PlatformVideoFramePool::PlatformVideoFramePool()
+    : create_frame_cb_(base::BindRepeating(&DefaultCreateFrame)) {
   DVLOGF(4);
   weak_this_ = weak_this_factory_.GetWeakPtr();
 }
@@ -107,11 +103,19 @@ scoped_refptr<VideoFrame> PlatformVideoFramePool::GetFrame() {
     // with (10, 20), 100x100 we cannot (even though it's contained in the
     // former). Hence the use of GetRectSizeFromOrigin() to calculate the
     // visible rect for |new_frame|.
+    //
+    // TODO(b/230370976): after https://crrev.com/c/3597211,
+    // PlatformVideoFramePool doesn't use a GpuMemoryBufferFactory for
+    // allocating dma-bufs which means DRM framebuffers won't be created for a
+    // dma-buf at allocation time (instead, it will be created at the moment of
+    // creating a SharedImage). That means that we probably don't need to take
+    // the |visible_rect_| into account for IsSameFormat_Locked() any more which
+    // implies that we can create |new_frame| using gfx::Rect(coded_size) as
+    // the visible rectangle.
     CHECK(use_linear_buffers_.has_value());
     CroStatus::Or<scoped_refptr<VideoFrame>> new_frame = create_frame_cb_.Run(
-        gpu_memory_buffer_factory_, format, coded_size,
-        gfx::Rect(GetRectSizeFromOrigin(visible_rect_)), coded_size,
-        use_protected_, *use_linear_buffers_, base::TimeDelta());
+        format, coded_size, gfx::Rect(GetRectSizeFromOrigin(visible_rect_)),
+        coded_size, use_protected_, *use_linear_buffers_, base::TimeDelta());
     if (new_frame.has_error()) {
       // TODO(crbug.com/c/1103510) Push the error up instead of dropping it.
       return nullptr;
@@ -195,12 +199,19 @@ CroStatus::Or<GpuBufferLayout> PlatformVideoFramePool::Initialize(
   // hardware overlay purposes. The caveat is that different visible rectangles
   // can map to the same framebuffer size, i.e., all the visible rectangles with
   // the same bottom-right corner map to the same framebuffer size.
+  //
+  // TODO(b/230370976): after https://crrev.com/c/3597211,
+  // PlatformVideoFramePool doesn't use a GpuMemoryBufferFactory for allocating
+  // dma-bufs which means DRM framebuffers won't be created for a dma-buf at
+  // allocation time (instead, it will be created at the moment of creating a
+  // SharedImage). That means that we probably don't need to take the
+  // |visible_rect| into account for IsSameFormat_Locked() any more.
   if (!IsSameFormat_Locked(format, coded_size, visible_rect, use_protected)) {
     DVLOGF(4) << "The video frame format is changed. Clearing the pool.";
     free_frames_.clear();
     auto maybe_frame = create_frame_cb_.Run(
-        gpu_memory_buffer_factory_, format, coded_size, visible_rect,
-        natural_size, use_protected, *use_linear_buffers_, base::TimeDelta());
+        format, coded_size, visible_rect, natural_size, use_protected,
+        *use_linear_buffers_, base::TimeDelta());
     if (maybe_frame.has_error())
       return std::move(maybe_frame).error();
     auto frame = std::move(maybe_frame).value();
diff --git a/chromium/media/gpu/chromeos/platform_video_frame_pool.h b/chromium/media/gpu/chromeos/platform_video_frame_pool.h
index 456a3eef798..e16e9e4419f 100644
--- a/chromium/media/gpu/chromeos/platform_video_frame_pool.h
+++ b/chromium/media/gpu/chromeos/platform_video_frame_pool.h
@@ -37,12 +37,9 @@ namespace media {
 // old parameter values will be purged from the pool.
 class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
  public:
-  explicit PlatformVideoFramePool(
-      gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory);
-
+  PlatformVideoFramePool();
   PlatformVideoFramePool(const PlatformVideoFramePool&) = delete;
   PlatformVideoFramePool& operator=(const PlatformVideoFramePool&) = delete;
-
   ~PlatformVideoFramePool() override;
 
   // Returns the ID of the GpuMemoryBuffer wrapped by |frame|.
@@ -111,11 +108,6 @@ class MEDIA_GPU_EXPORT PlatformVideoFramePool : public DmabufVideoFramePool {
   // The function used to allocate new frames.
   CreateFrameCB create_frame_cb_ GUARDED_BY(lock_);
 
-  // Used to allocate the video frame GpuMemoryBuffers, passed directly to
-  // the callback that creates video frames. Indirectly owned by GpuChildThread;
-  // therefore alive as long as the GPU process is.
-  gpu::GpuMemoryBufferFactory* const gpu_memory_buffer_factory_ = nullptr;
-
   // The arguments of current frame. We allocate new frames only if a pixel
   // format or size in |frame_layout_| is changed. When GetFrame() is
   // called, we update |visible_rect_| and |natural_size_| of wrapped frames.
diff --git a/chromium/media/gpu/chromeos/platform_video_frame_utils.cc b/chromium/media/gpu/chromeos/platform_video_frame_utils.cc
index 57a4a06452c..7e585c4c27e 100644
--- a/chromium/media/gpu/chromeos/platform_video_frame_utils.cc
+++ b/chromium/media/gpu/chromeos/platform_video_frame_utils.cc
@@ -21,9 +21,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/synchronization/lock.h"
-#include "gpu/ipc/common/gpu_client_ids.h"
 #include "gpu/ipc/common/gpu_memory_buffer_support.h"
-#include "gpu/ipc/service/gpu_memory_buffer_factory.h"
 #include "media/base/color_plane_layout.h"
 #include "media/base/format_utils.h"
 #include "media/base/scopedfd_helper.h"
@@ -168,38 +166,15 @@ class GbmDeviceWrapper {
 };
 
 gfx::GpuMemoryBufferHandle AllocateGpuMemoryBufferHandle(
-    gpu::GpuMemoryBufferFactory* factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
-    const gfx::Rect& visible_rect,
-    gfx::BufferUsage buffer_usage,
-    base::ScopedClosureRunner& destroy_cb) {
+    gfx::BufferUsage buffer_usage) {
   gfx::GpuMemoryBufferHandle gmb_handle;
   auto buffer_format = VideoPixelFormatToGfxBufferFormat(pixel_format);
   if (!buffer_format)
     return gmb_handle;
-
-  if (!factory) {
-    return GbmDeviceWrapper::Get()->CreateGpuMemoryBuffer(
-        *buffer_format, coded_size, buffer_usage);
-  }
-
-  gmb_handle = factory->CreateGpuMemoryBuffer(
-      GetNextGpuMemoryBufferId(), coded_size,
-      /*framebuffer_size=*/GetRectSizeFromOrigin(visible_rect), *buffer_format,
-      buffer_usage, gpu::kPlatformVideoFramePoolClientId,
-      gfx::kNullAcceleratedWidget);
-  DCHECK(gmb_handle.is_null() || gmb_handle.type != gfx::NATIVE_PIXMAP ||
-         VideoFrame::NumPlanes(pixel_format) ==
-             gmb_handle.native_pixmap_handle.planes.size());
-  if (gmb_handle.is_null())
-    return gmb_handle;
-  destroy_cb.ReplaceClosure(
-      base::BindOnce(&gpu::GpuMemoryBufferFactory::DestroyGpuMemoryBuffer,
-                     base::Unretained(factory), gmb_handle.id,
-                     gpu::kPlatformVideoFramePoolClientId));
-
-  return gmb_handle;
+  return GbmDeviceWrapper::Get()->CreateGpuMemoryBuffer(
+      *buffer_format, coded_size, buffer_usage);
 }
 }  // namespace
 
@@ -212,17 +187,14 @@ gfx::GpuMemoryBufferId GetNextGpuMemoryBufferId() {
 }
 
 scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
-    gpu::GpuMemoryBufferFactory* factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
     base::TimeDelta timestamp,
     gfx::BufferUsage buffer_usage) {
-  base::ScopedClosureRunner destroy_cb((base::DoNothing()));
   auto gmb_handle =
-      AllocateGpuMemoryBufferHandle(factory, pixel_format, coded_size,
-                                    visible_rect, buffer_usage, destroy_cb);
+      AllocateGpuMemoryBufferHandle(pixel_format, coded_size, buffer_usage);
   if (gmb_handle.is_null() || gmb_handle.type != gfx::NATIVE_PIXMAP)
     return nullptr;
 
@@ -245,9 +217,6 @@ scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
       visible_rect, natural_size, std::move(gpu_memory_buffer), mailbox_holders,
       base::NullCallback(), timestamp);
 
-  if (frame)
-    frame->AddDestructionObserver(destroy_cb.Release());
-
   // We only support importing non-DISJOINT multi-planar GbmBuffer right now.
   // TODO(crbug.com/1258986): Add DISJOINT support.
   frame->metadata().is_webgpu_compatible = supports_zero_copy_webgpu_import;
@@ -256,17 +225,14 @@ scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
 }
 
 scoped_refptr<VideoFrame> CreatePlatformVideoFrame(
-    gpu::GpuMemoryBufferFactory* factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
     const gfx::Size& natural_size,
     base::TimeDelta timestamp,
     gfx::BufferUsage buffer_usage) {
-  base::ScopedClosureRunner destroy_cb((base::DoNothing()));
   auto gmb_handle =
-      AllocateGpuMemoryBufferHandle(factory, pixel_format, coded_size,
-                                    visible_rect, buffer_usage, destroy_cb);
+      AllocateGpuMemoryBufferHandle(pixel_format, coded_size, buffer_usage);
   if (gmb_handle.is_null() || gmb_handle.type != gfx::NATIVE_PIXMAP)
     return nullptr;
 
@@ -291,20 +257,18 @@ scoped_refptr<VideoFrame> CreatePlatformVideoFrame(
   if (!frame)
     return nullptr;
 
-  frame->AddDestructionObserver(destroy_cb.Release());
   return frame;
 }
 
 absl::optional<VideoFrameLayout> GetPlatformVideoFrameLayout(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     gfx::BufferUsage buffer_usage) {
   // |visible_rect| and |natural_size| do not matter here. |coded_size| is set
   // as a dummy variable.
-  auto frame = CreatePlatformVideoFrame(
-      gpu_memory_buffer_factory, pixel_format, coded_size,
-      gfx::Rect(coded_size), coded_size, base::TimeDelta(), buffer_usage);
+  auto frame =
+      CreatePlatformVideoFrame(pixel_format, coded_size, gfx::Rect(coded_size),
+                               coded_size, base::TimeDelta(), buffer_usage);
   return frame ? absl::make_optional<VideoFrameLayout>(frame->layout())
                : absl::nullopt;
 }
diff --git a/chromium/media/gpu/chromeos/platform_video_frame_utils.h b/chromium/media/gpu/chromeos/platform_video_frame_utils.h
index 89833bb8130..af278c8ce3d 100644
--- a/chromium/media/gpu/chromeos/platform_video_frame_utils.h
+++ b/chromium/media/gpu/chromeos/platform_video_frame_utils.h
@@ -13,27 +13,16 @@
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gfx/linux/native_pixmap_dmabuf.h"
 
-namespace gpu {
-class GpuMemoryBufferFactory;
-}  // namespace gpu
-
 namespace media {
 
 // Returns a GpuMemoryBufferId that's guaranteed to be different from those
 // returned by previous calls. This function is thread safe.
 MEDIA_GPU_EXPORT gfx::GpuMemoryBufferId GetNextGpuMemoryBufferId();
 
-// Create GpuMemoryBuffer-based media::VideoFrame with |buffer_usage|.
-// See //media/base/video_frame.h for other parameters.
-// If |gpu_memory_buffer_factory| is not null, it's used to allocate the
-// GpuMemoryBuffer and it must outlive the returned VideoFrame. If it's null,
-// the buffer is allocated using the render node (this is intended to be used
-// only for the internals of video encoding when the usage is
-// VEA_READ_CAMERA_AND_CPU_READ_WRITE). It's safe to call this function
-// concurrently from multiple threads (as long as either
-// |gpu_memory_buffer_factory| is thread-safe or nullptr).
+// Creates a STORAGE_GPU_MEMORY_BUFFER VideoFrame backed by a NATIVE_PIXMAP
+// GpuMemoryBuffer allocated with |buffer_usage|. See //media/base/video_frame.h
+// for the other parameters. This function is thread-safe.
 MEDIA_GPU_EXPORT scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
@@ -41,17 +30,10 @@ MEDIA_GPU_EXPORT scoped_refptr<VideoFrame> CreateGpuMemoryBufferVideoFrame(
     base::TimeDelta timestamp,
     gfx::BufferUsage buffer_usage);
 
-// Create platform dependent media::VideoFrame with |buffer_usage|.
-// See //media/base/video_frame.h for other parameters.
-// If |gpu_memory_buffer_factory| is not null, it's used to allocate the
-// video frame's storage and it must outlive the returned VideoFrame. If it's
-// null, the buffer is allocated using the render node (this is intended to be
-// used only for the internals of video encoding when the usage is
-// VEA_READ_CAMERA_AND_CPU_READ_WRITE). It's safe to call this function
-// concurrently from multiple threads (as long as either
-// |gpu_memory_buffer_factory| is thread-safe or nullptr).
+// Creates a STORAGE_DMABUFS VideoFrame whose buffer is allocated with
+// |buffer_usage|. See //media/base/video_frame.h for the other parameters. This
+// function is thread-safe.
 MEDIA_GPU_EXPORT scoped_refptr<VideoFrame> CreatePlatformVideoFrame(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
@@ -59,17 +41,13 @@ MEDIA_GPU_EXPORT scoped_refptr<VideoFrame> CreatePlatformVideoFrame(
     base::TimeDelta timestamp,
     gfx::BufferUsage buffer_usage);
 
-// Get VideoFrameLayout of platform dependent video frame with |pixel_format|,
-// |coded_size| and |buffer_usage|. This function is not cost-free as this
-// allocates a platform dependent video frame.
-// If |gpu_memory_buffer_factory| is not null, it's used to allocate the
-// video frame's storage. If it's null, the storage is allocated using the
-// render node (this is intended to be used only for the internals of video
-// encoding when the usage is VEA_READ_CAMERA_AND_CPU_READ_WRITE). It's
-// safe to call this function concurrently from multiple threads (as long as
-// either |gpu_memory_buffer_factory| is thread-safe or nullptr).
+// Returns the VideoFrameLayout of a VideoFrame allocated with
+// CreatePlatformVideoFrame(), i.e., all parameters are forwarded to that
+// function (|visible_rect| is set to gfx::Rect(|coded_size|), |natural_size| is
+// set to |coded_size|, and |timestamp| is set to base::TimeDelta()). This
+// function is not cheap as it allocates a buffer. Returns absl::nullopt if the
+// buffer allocation fails. This function is thread-safe.
 MEDIA_GPU_EXPORT absl::optional<VideoFrameLayout> GetPlatformVideoFrameLayout(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat pixel_format,
     const gfx::Size& coded_size,
     gfx::BufferUsage buffer_usage);
diff --git a/chromium/media/gpu/chromeos/video_decoder_pipeline.cc b/chromium/media/gpu/chromeos/video_decoder_pipeline.cc
index 3ec81996dac..d361aeacbf4 100644
--- a/chromium/media/gpu/chromeos/video_decoder_pipeline.cc
+++ b/chromium/media/gpu/chromeos/video_decoder_pipeline.cc
@@ -732,13 +732,8 @@ VideoDecoderPipeline::PickDecoderOutputFormat(
 
   if (need_aux_frame_pool) {
     // Initialize the auxiliary frame pool with the input format of the image
-    // processor. Note that we pass nullptr as the GpuMemoryBufferFactory. That
-    // way, the pool will allocate buffers using minigbm directly instead of
-    // going through Ozone which means it won't create DRM/KMS framebuffers for
-    // those buffers. This is good because these buffers don't end up as
-    // overlays anyway.
-    auxiliary_frame_pool_ = std::make_unique<PlatformVideoFramePool>(
-        /*gpu_memory_buffer_factory=*/nullptr);
+    // processor.
+    auxiliary_frame_pool_ = std::make_unique<PlatformVideoFramePool>();
 
     auxiliary_frame_pool_->set_parent_task_runner(decoder_task_runner_);
     CroStatus::Or<GpuBufferLayout> status_or_layout =
diff --git a/chromium/media/gpu/v4l2/v4l2_video_encode_accelerator.cc b/chromium/media/gpu/v4l2/v4l2_video_encode_accelerator.cc
index 34c884049c2..880cbf2a172 100644
--- a/chromium/media/gpu/v4l2/v4l2_video_encode_accelerator.cc
+++ b/chromium/media/gpu/v4l2/v4l2_video_encode_accelerator.cc
@@ -417,7 +417,7 @@ bool V4L2VideoEncodeAccelerator::CreateImageProcessor(
   }
 
   auto platform_layout = GetPlatformVideoFrameLayout(
-      /*gpu_memory_buffer_factory=*/nullptr, output_format, output_size,
+      output_format, output_size,
       gfx::BufferUsage::VEA_READ_CAMERA_AND_CPU_READ_WRITE);
   if (!platform_layout) {
     VLOGF(1) << "Failed to get Platform VideoFrameLayout";
@@ -487,7 +487,6 @@ bool V4L2VideoEncodeAccelerator::AllocateImageProcessorOutputBuffers(
     switch (output_config.storage_type()) {
       case VideoFrame::STORAGE_GPU_MEMORY_BUFFER:
         image_processor_output_buffers_[i] = CreateGpuMemoryBufferVideoFrame(
-            /*gpu_memory_buffer_factory=*/nullptr,
             output_config.fourcc.ToVideoPixelFormat(), output_config.size,
             output_config.visible_rect, output_config.visible_rect.size(),
             base::TimeDelta(),
@@ -1667,8 +1666,7 @@ bool V4L2VideoEncodeAccelerator::SetFormats(VideoPixelFormat input_format,
   gfx::Size input_size = encoder_input_visible_rect_.size();
   if (native_input_mode_) {
     auto input_layout = GetPlatformVideoFrameLayout(
-        /*gpu_memory_buffer_factory=*/nullptr, input_format,
-        encoder_input_visible_rect_.size(),
+        input_format, encoder_input_visible_rect_.size(),
         gfx::BufferUsage::VEA_READ_CAMERA_AND_CPU_READ_WRITE);
     if (!input_layout)
       return false;
diff --git a/chromium/media/gpu/vaapi/vaapi_video_decoder.cc b/chromium/media/gpu/vaapi/vaapi_video_decoder.cc
index 47c682edbc4..a473cdf3f9e 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_decoder.cc
+++ b/chromium/media/gpu/vaapi/vaapi_video_decoder.cc
@@ -795,8 +795,7 @@ void VaapiVideoDecoder::ApplyResolutionChangeWithScreenSizes(
   // TODO(b/203240043): Create a GMB directly instead of allocating a
   // VideoFrame.
   scoped_refptr<VideoFrame> dummy_frame = CreateGpuMemoryBufferVideoFrame(
-      /*gpu_memory_buffer_factory=*/nullptr, *format, decoder_pic_size,
-      decoder_visible_rect, decoder_natural_size,
+      *format, decoder_pic_size, decoder_visible_rect, decoder_natural_size,
       /*timestamp=*/base::TimeDelta(),
       cdm_context_ref_ ? gfx::BufferUsage::PROTECTED_SCANOUT_VDA_WRITE
                        : gfx::BufferUsage::SCANOUT_VDA_WRITE);
@@ -840,7 +839,6 @@ void VaapiVideoDecoder::ApplyResolutionChangeWithScreenSizes(
 CroStatus::Or<scoped_refptr<VideoFrame>>
 VaapiVideoDecoder::AllocateCustomFrameProxy(
     base::WeakPtr<VaapiVideoDecoder> decoder,
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
@@ -850,13 +848,12 @@ VaapiVideoDecoder::AllocateCustomFrameProxy(
     base::TimeDelta timestamp) {
   if (!decoder)
     return CroStatus::Codes::kFailedToCreateVideoFrame;
-  return decoder->AllocateCustomFrame(
-      gpu_memory_buffer_factory, format, coded_size, visible_rect, natural_size,
-      use_protected, use_linear_buffers, timestamp);
+  return decoder->AllocateCustomFrame(format, coded_size, visible_rect,
+                                      natural_size, use_protected,
+                                      use_linear_buffers, timestamp);
 }
 
 CroStatus::Or<scoped_refptr<VideoFrame>> VaapiVideoDecoder::AllocateCustomFrame(
-    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     VideoPixelFormat format,
     const gfx::Size& coded_size,
     const gfx::Rect& visible_rect,
diff --git a/chromium/media/gpu/vaapi/vaapi_video_decoder.h b/chromium/media/gpu/vaapi/vaapi_video_decoder.h
index f7462189db4..7c2e40a4578 100644
--- a/chromium/media/gpu/vaapi/vaapi_video_decoder.h
+++ b/chromium/media/gpu/vaapi/vaapi_video_decoder.h
@@ -36,10 +36,6 @@
 #include "ui/gfx/gpu_memory_buffer.h"
 #include "ui/gfx/hdr_metadata.h"
 
-namespace gpu {
-class GpuMemoryBufferFactory;
-}  // namespace gpu
-
 namespace media {
 
 class AcceleratedVideoDecoder;
@@ -176,7 +172,6 @@ class VaapiVideoDecoder : public VideoDecoderMixin,
   // Private static helper to allow using weak ptr instead of an unretained ptr.
   static CroStatus::Or<scoped_refptr<VideoFrame>> AllocateCustomFrameProxy(
       base::WeakPtr<VaapiVideoDecoder> decoder,
-      gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
       VideoPixelFormat format,
       const gfx::Size& coded_size,
       const gfx::Rect& visible_rect,
@@ -189,7 +184,6 @@ class VaapiVideoDecoder : public VideoDecoderMixin,
   // only used on linux, it also sets the required YCbCr information for the
   // frame it creates.
   CroStatus::Or<scoped_refptr<VideoFrame>> AllocateCustomFrame(
-      gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
       VideoPixelFormat format,
       const gfx::Size& coded_size,
       const gfx::Rect& visible_rect,
diff --git a/chromium/media/mojo/services/gpu_mojo_media_client_cros.cc b/chromium/media/mojo/services/gpu_mojo_media_client_cros.cc
index f34b6108978..880664d3f84 100644
--- a/chromium/media/mojo/services/gpu_mojo_media_client_cros.cc
+++ b/chromium/media/mojo/services/gpu_mojo_media_client_cros.cc
@@ -108,8 +108,7 @@ std::unique_ptr<VideoDecoder> CreatePlatformVideoDecoder(
                                                  traits.gpu_info)) {
     case VideoDecoderType::kVaapi:
     case VideoDecoderType::kV4L2: {
-      auto frame_pool = std::make_unique<PlatformVideoFramePool>(
-          traits.gpu_memory_buffer_factory);
+      auto frame_pool = std::make_unique<PlatformVideoFramePool>();
       auto frame_converter = MailboxVideoFrameConverter::Create(
           base::BindRepeating(&PlatformVideoFramePool::UnwrapFrame,
                               base::Unretained(frame_pool.get())),