From 68855c577a9bd5e3d4b6ea5fad41b04f1ee684f8 Mon Sep 17 00:00:00 2001
From: Min Qin <qinmin@chromium.org>
Date: Thu, 11 Jun 2026 00:01:46 -0700
Subject: [PATCH] Secure MHTML generation by introducing a Mojo Data Pipe on all platforms.

This CL secures the MHTML generation path by introducing a Mojo Data
Pipe on all platforms (including POSIX and Windows):
    1. The browser process creates a Mojo Data Pipe, passing the Producer handle to the renderer and retaining the Consumer handle.
    2. A new helper class, MHTMLDataPipeReader, runs on the blocking download task runner to read incoming serialized MHTML data from the Consumer handle and write it safely to disk in the browser process.
    3. MHTMLHandleWriter and its subclasses are updated to use a self-destruction mechanism via std::unique_ptr (passing the unique_ptr through the asynchronous task/callback chain) to guarantee robust lifetime management during the Mojo streaming process. This completely avoids sequence lifetime concerns and potential memory leaks upon unexpected termination.
    4. Legacy mojo::SimpleWatcher member and includes are removed from the browser process, as the asynchronous reading is now entirely driven by mojo::DataPipeDrainer.

Bug: 514006886
Change-Id: Icf51a14c5422e725f2a99e69ed964f166b788a6a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7883815
Commit-Queue: Min Qin <qinmin@chromium.org>
Reviewed-by: Justin DeWitt <dewittj@chromium.org>
Reviewed-by: Daniel Cheng <dcheng@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1645142}
---
diff --git a/content/browser/download/mhtml_generation_manager.cc b/content/browser/download/mhtml_generation_manager.cc
index 511dd0f4..e089638 100644
--- a/content/browser/download/mhtml_generation_manager.cc
+++ b/content/browser/download/mhtml_generation_manager.cc
@@ -18,6 +18,8 @@
 #include "base/strings/string_util.h"
 #include "base/strings/string_view_util.h"
 #include "base/strings/stringprintf.h"
+#include "base/task/sequenced_task_runner.h"
+#include "base/threading/sequence_bound.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "base/types/optional_util.h"
@@ -37,6 +39,8 @@
 #include "content/public/common/mhtml_generation_params.h"
 #include "mojo/core/embedder/embedder.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "mojo/public/cpp/system/data_pipe_drainer.h"
 #include "net/base/mime_util.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/perfetto/include/perfetto/tracing/track.h"
@@ -130,6 +134,69 @@
   return browser_file;
 }
 
+class MHTMLDataPipeReader : public mojo::DataPipeDrainer::Client {
+ public:
+  using CompletionCallback =
+      base::OnceCallback<void(content::mojom::MhtmlSaveStatus)>;
+
+  MHTMLDataPipeReader(base::File file,
+                      mojo::ScopedDataPipeConsumerHandle consumer_handle,
+                      CompletionCallback callback)
+      : file_(std::move(file)),
+        consumer_handle_(std::move(consumer_handle)),
+        callback_(std::move(callback)) {}
+
+  MHTMLDataPipeReader(const MHTMLDataPipeReader&) = delete;
+  MHTMLDataPipeReader& operator=(const MHTMLDataPipeReader&) = delete;
+
+  ~MHTMLDataPipeReader() override = default;
+
+  void Start() {
+    DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
+    drainer_ = std::make_unique<mojo::DataPipeDrainer>(
+        this, std::move(consumer_handle_));
+  }
+
+  // mojo::DataPipeDrainer::Client:
+  void OnDataAvailable(base::span<const uint8_t> data) override {
+    DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
+    if (completed_) {
+      return;
+    }
+    if (!file_.WriteAtCurrentPosAndCheck(data)) {
+      Complete(content::mojom::MhtmlSaveStatus::kFileWritingError);
+    }
+  }
+
+  void OnDataComplete() override {
+    DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
+    Complete(content::mojom::MhtmlSaveStatus::kSuccess);
+  }
+
+ private:
+  void Complete(content::mojom::MhtmlSaveStatus status) {
+    DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
+    if (completed_) {
+      return;
+    }
+    completed_ = true;
+    // We do not reset |drainer_| here because this method can be called
+    // synchronously from OnDataAvailable() (which is called by the drainer).
+    // Resetting it synchronously would destroy the drainer while it is still
+    // executing on the stack, leading to a Use-After-Free. The drainer will
+    // be safely destroyed asynchronously when this MHTMLDataPipeReader is
+    // deleted.
+    content::GetUIThreadTaskRunner({})->PostTask(
+        FROM_HERE, base::BindOnce(std::move(callback_), status));
+  }
+
+  base::File file_;
+  mojo::ScopedDataPipeConsumerHandle consumer_handle_;
+  std::unique_ptr<mojo::DataPipeDrainer> drainer_;
+  CompletionCallback callback_;
+  bool completed_ = false;
+};
+
 }  // namespace
 
 namespace content {
@@ -176,8 +243,7 @@
       mojom::MhtmlSaveStatus save_status,
       const std::string& boundary,
       base::File file,
-      const std::vector<MHTMLExtraDataPart>& extra_data_parts,
-      std::unique_ptr<mojo::SimpleWatcher> watcher);
+      const std::vector<MHTMLExtraDataPart>& extra_data_parts);
 
   // Creates a string that encompasses any remaining extra data parts to write
   // to the file.
@@ -285,17 +351,16 @@
   // MHTMLFileWriter instance for the frame being currently serialized.
   mojo::AssociatedRemote<mojom::MhtmlFileWriter> writer_;
 
-  // Watcher to detect new data written to |mhtml_data_consumer_|.
-  // This is instantiated and destroyed in the download sequence for each frame.
-  std::unique_ptr<mojo::SimpleWatcher> watcher_;
 
-  // Consumer handle for data pipe streaming.
-  mojo::ScopedDataPipeConsumerHandle mhtml_data_consumer_;
 
   // Indicates whether there is currently data being streamed from the Renderer.
   // Not used when the renderer is writing directly to file.
   bool waiting_on_data_streaming_;
 
+  // The reader responsible for reading the MHTML data from the Mojo data pipe
+  // and writing it to the file.
+  base::SequenceBound<MHTMLDataPipeReader> pipe_reader_;
+
   base::WeakPtrFactory<Job> weak_factory_{this};
 };
 
@@ -313,7 +378,6 @@
 
 MHTMLGenerationManager::Job::~Job() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(!watcher_);
 }
 
 void MHTMLGenerationManager::Job::initializeJob(WebContents* web_contents) {
@@ -394,10 +458,29 @@
 
   mojom::SerializeAsMHTMLParamsPtr params(CreateMojoParams());
 
-  // File::Duplicate() creates a reference to this file for use in the
-  // Renderer.
+  mojo::ScopedDataPipeProducerHandle producer;
+  mojo::ScopedDataPipeConsumerHandle consumer;
+  MojoResult result = mojo::CreateDataPipe(nullptr, producer, consumer);
+  if (result != MOJO_RESULT_OK) {
+    return mojom::MhtmlSaveStatus::kStreamingError;
+  }
+
   params->output_handle =
-      mojom::MhtmlOutputHandle::NewFileHandle(browser_file_.Duplicate());
+      mojom::MhtmlOutputHandle::NewProducerHandle(std::move(producer));
+
+  waiting_on_data_streaming_ = true;
+
+  base::File file_copy = browser_file_.Duplicate();
+  if (!file_copy.IsValid()) {
+    return mojom::MhtmlSaveStatus::kFileCreationError;
+  }
+
+  pipe_reader_.emplace(
+      download::GetDownloadTaskRunner(), std::move(file_copy),
+      std::move(consumer),
+      base::BindOnce(&Job::DoneWritingToDisk, weak_factory_.GetWeakPtr()));
+
+  pipe_reader_.AsyncCall(&MHTMLDataPipeReader::Start);
 
   // Send a Mojo request to Renderer to serialize its frame.
   DCHECK(frame_tree_node_id_of_busy_frame_.is_null());
@@ -419,10 +502,14 @@
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   // If the Job has prematurely finalized and marked as finished, make this
-  // response no-op.
+  // response a no-op. This can happen if MHTMLDataPipeReader posted this task
+  // to the UI thread before it was reset in MarkAsFinished(). Since the Job
+  // is still alive waiting for the file to close, the weak pointer remains
+  // valid and this task will still run.
   if (is_finished_)
     return;
 
+  pipe_reader_.Reset();
   waiting_on_data_streaming_ = false;
   MaybeSendToNextRenderFrame(save_status);
 }
@@ -474,11 +561,15 @@
   }
   is_finished_ = true;
   writer_.reset();
+  pipe_reader_.Reset();
 
-  // Additionally, |watcher_| may also invoke DoneWritingToDisk() from
-  // the download sequence, potentially calling this twice. We cannot disable
-  // |watcher_| notifications similar to |writer_|, since it exists in
-  // the download sequence, so we handle the case in DoneWritingToDisk().
+  // Additionally, MHTMLDataPipeReader may have already posted
+  // DoneWritingToDisk() to the UI thread before we reset it here. Since the Job
+  // is still alive (waiting for the file to close on the download thread), the
+  // weak pointer remains valid, and DoneWritingToDisk() will eventually run. To
+  // prevent this from causing MarkAsFinished() to be called again (which would
+  // hit the NOTREACHED() above), we handle this case by returning early in
+  // DoneWritingToDisk() if |is_finished_| is true.
 
   TRACE_EVENT_INSTANT("page-serialization",
                       perfetto::StaticString("JobFinished"),
@@ -500,8 +591,7 @@
       FROM_HERE,
       base::BindOnce(&MHTMLGenerationManager::Job::FinalizeOnFileThread,
                      save_status, mhtml_boundary_marker_,
-                     std::move(browser_file_), std::move(extra_data_parts_),
-                     std::move(watcher_)),
+                     std::move(browser_file_), std::move(extra_data_parts_)),
       base::BindOnce(&Job::OnFinished, weak_factory_.GetWeakPtr()));
 }
 
@@ -586,11 +676,8 @@
     mojom::MhtmlSaveStatus save_status,
     const std::string& boundary,
     base::File file,
-    const std::vector<MHTMLExtraDataPart>& extra_data_parts,
-    std::unique_ptr<mojo::SimpleWatcher> watcher) {
+    const std::vector<MHTMLExtraDataPart>& extra_data_parts) {
   DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
-
-  watcher.reset();
   DCHECK(!boundary.empty());
 
   if (save_status == mojom::MhtmlSaveStatus::kSuccess) {
diff --git a/content/renderer/mhtml_handle_writer.cc b/content/renderer/mhtml_handle_writer.cc
index e0baea3..9c387216 100644
--- a/content/renderer/mhtml_handle_writer.cc
+++ b/content/renderer/mhtml_handle_writer.cc
@@ -12,6 +12,7 @@
 #include "base/trace_event/trace_event.h"
 #include "content/common/download/mhtml_file_writer.mojom.h"
 #include "content/public/renderer/render_thread.h"
+#include "mojo/public/cpp/system/data_pipe_producer.h"
 #include "third_party/blink/public/platform/web_thread_safe_data.h"
 #include "third_party/perfetto/include/perfetto/tracing/track.h"
 
@@ -23,18 +24,20 @@
     : main_thread_task_runner_(std::move(main_thread_task_runner)),
       callback_(std::move(callback)) {}
 
-MHTMLHandleWriter::~MHTMLHandleWriter() {}
+MHTMLHandleWriter::~MHTMLHandleWriter() = default;
 
 void MHTMLHandleWriter::WriteContents(
+    std::unique_ptr<MHTMLHandleWriter> self,
     std::vector<blink::WebThreadSafeData> mhtml_contents) {
   TRACE_EVENT_BEGIN(
       "page-serialization", "Writing MHTML contents to handle",
       perfetto::NamedTrack::FromPointer("content::MHTMLHandleWriter", this));
   is_writing_ = true;
-  WriteContentsImpl(std::move(mhtml_contents));
+  WriteContentsImpl(std::move(self), std::move(mhtml_contents));
 }
 
-void MHTMLHandleWriter::Finish(mojom::MhtmlSaveStatus save_status) {
+void MHTMLHandleWriter::Finish(std::unique_ptr<MHTMLHandleWriter> self,
+                               mojom::MhtmlSaveStatus save_status) {
   DCHECK(!RenderThread::IsMainThread())
       << "Should not run in the main renderer thread";
   if (is_writing_) {
@@ -67,116 +70,145 @@
 MHTMLFileHandleWriter::~MHTMLFileHandleWriter() {}
 
 void MHTMLFileHandleWriter::WriteContentsImpl(
+    std::unique_ptr<MHTMLHandleWriter> self,
     std::vector<blink::WebThreadSafeData> mhtml_contents) {
   for (const auto& data : mhtml_contents) {
     if (data.IsEmpty()) {
       continue;
     }
     if (!file_.WriteAtCurrentPosAndCheck(base::as_byte_span(data))) {
-      Finish(mojom::MhtmlSaveStatus::kFileWritingError);
+      Finish(std::move(self), mojom::MhtmlSaveStatus::kFileWritingError);
       return;
     }
   }
-  Finish(mojom::MhtmlSaveStatus::kSuccess);
+  Finish(std::move(self), mojom::MhtmlSaveStatus::kSuccess);
 }
 
 void MHTMLFileHandleWriter::Close() {
   file_.Close();
 }
 
+namespace {
+
+class MHTMLDataSource : public mojo::DataPipeProducer::DataSource {
+ public:
+  explicit MHTMLDataSource(std::vector<blink::WebThreadSafeData> mhtml_contents)
+      : mhtml_contents_(std::move(mhtml_contents)) {
+    for (const auto& data : mhtml_contents_) {
+      total_size_ += data.size();
+    }
+  }
+
+  MHTMLDataSource(const MHTMLDataSource&) = delete;
+  MHTMLDataSource& operator=(const MHTMLDataSource&) = delete;
+
+  ~MHTMLDataSource() override = default;
+
+  // mojo::DataPipeProducer::DataSource:
+  uint64_t GetLength() const override { return total_size_; }
+
+  ReadResult Read(uint64_t offset, base::span<char> buffer) override {
+    ReadResult result;
+    if (offset != current_offset_) {
+      result.result = MOJO_RESULT_INVALID_ARGUMENT;
+      return result;
+    }
+
+    size_t bytes_to_read = buffer.size();
+    size_t bytes_read = 0;
+
+    while (bytes_to_read > 0 &&
+           current_buffer_index_ < mhtml_contents_.size()) {
+      const auto& data = mhtml_contents_[current_buffer_index_];
+      size_t data_size = data.size();
+
+      DCHECK_GE(data_size, offset_in_current_buffer_);
+      size_t available_in_buffer = data_size - offset_in_current_buffer_;
+
+      if (available_in_buffer == 0) {
+        current_buffer_index_++;
+        offset_in_current_buffer_ = 0;
+        continue;
+      }
+
+      size_t copy_size = std::min(bytes_to_read, available_in_buffer);
+
+      base::as_writable_bytes(buffer.subspan(bytes_read, copy_size))
+          .copy_from(base::as_byte_span(data).subspan(offset_in_current_buffer_,
+                                                      copy_size));
+
+      bytes_read += copy_size;
+      bytes_to_read -= copy_size;
+      offset_in_current_buffer_ += copy_size;
+      current_offset_ += copy_size;
+
+      if (offset_in_current_buffer_ == data_size) {
+        current_buffer_index_++;
+        offset_in_current_buffer_ = 0;
+      }
+    }
+
+    result.bytes_read = bytes_read;
+    result.result = MOJO_RESULT_OK;
+    return result;
+  }
+
+ private:
+  const std::vector<blink::WebThreadSafeData> mhtml_contents_;
+  uint64_t total_size_ = 0;
+  size_t current_buffer_index_ = 0;
+  size_t offset_in_current_buffer_ = 0;
+  uint64_t current_offset_ = 0;
+};
+
+}  // namespace
+
 MHTMLProducerHandleWriter::MHTMLProducerHandleWriter(
     scoped_refptr<base::TaskRunner> main_thread_task_runner,
     MHTMLWriteCompleteCallback callback,
     mojo::ScopedDataPipeProducerHandle producer)
     : MHTMLHandleWriter(std::move(main_thread_task_runner),
                         std::move(callback)),
-      producer_(std::move(producer)),
-      current_block_(0),
-      write_position_(0) {}
+      producer_(std::make_unique<mojo::DataPipeProducer>(std::move(producer))) {
+}
 
 void MHTMLProducerHandleWriter::WriteContentsImpl(
+    std::unique_ptr<MHTMLHandleWriter> self,
     std::vector<blink::WebThreadSafeData> mhtml_contents) {
-  DCHECK(mhtml_contents_.empty());
-  mhtml_contents_ = std::move(mhtml_contents);
-
   scoped_refptr<base::SequencedTaskRunner> task_runner =
       base::ThreadPool::CreateSequencedTaskRunner(
           {base::MayBlock(), base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
... (file diff truncated)

diff --git a/content/browser/download/mhtml_generation_browsertest.cc b/content/browser/download/mhtml_generation_browsertest.cc
index 66c6675..cfa602b 100644
--- a/content/browser/download/mhtml_generation_browsertest.cc
+++ b/content/browser/download/mhtml_generation_browsertest.cc
@@ -280,57 +280,60 @@
   void SerializeAsMHTML(mojom::SerializeAsMHTMLParamsPtr params,
                         SerializeAsMHTMLCallback callback) override {
     // Upon using the overridden mock interface implementation, this will be
-    // handled by the product code as illustrated below.  (1), (2), (3) depict
-    // points in time when product code runs on UI thread and download sequence.
-    // For the repro, the message pipe disconnection needs to happen between (1)
-    // and (3).
+    // handled by the product code as illustrated below. (1), (2), (3), (4)
+    // depict points in time when product code runs on UI thread and download
+    // sequence. For the repro, the message pipe disconnection needs to happen
+    // after the browser has completed writing to disk (2) and before the job is
+    // destroyed in OnFinished (4).
     //
-    //   Test instance     UI thread         download sequence
-    //     ---------       ---------           -----------
-    //        |                |                     |
-    //    WE ARE HERE          |                     |
-    //        |                |                     |
-    //        |                |                     |
-    //        +--------------->+                     |
-    //        |                |                     |
-    //        |                |                     |
-    //        |                |                     |
-    //        |                |                     |
-    //        |                |                     |
-    //        |                |                     |
-    // (1)    |      MHTMLGenerationManager::Job     |
-    //        |      ::SerializeAsMHTMLResponse      |
-    //        |                +-------------------->+
-    //        |                |                     |
-    //        |                |                     |
-    //        |                |                     |
-    // (2)    |                |          MHTMLGenerationManager::Job
-    //        |                |          ::CloseFileOnFileThread
-    //        |                |                     |
-    //        |                |                     |
-    //        |           test needs to              |
-    //        |       disconnect message pipe        |
-    //        |      HERE - between (1) and (3)      |
-    //        |                |                     |
-    //        |                |                     |
-    //        |                +<--------------------+
-    //        |                |                     |
-    // (3)    |      MHTMLGenerationManager          |
-    //        |      Job::OnFinished                 |
-    //        |                |                     |
+    //   Test instance      UI thread          download sequence
+    //     ---------        ---------            -----------
+    //        |                 |                      |
+    //    WE ARE HERE           |                      |
+    //        |                 |                      |
+    //        +---------------->+                      |
+    //        |                 |                      |
+    //        |                 |                      |
+    // (1)    |       MHTMLGenerationManager::Job      |
+    //        |       ::SerializeAsMHTMLResponse       |
+    //        |                 |                      |
+    //        |                 |                      |
+    //        |                 |               [Streams MHTML data]
+    //        |                 |                      +
+    // (2)    |                 +<---------------------+
+    //        |       MHTMLGenerationManager::Job      |
+    //        |       ::DoneWritingToDisk              |
+    //        |                 +-------------------->+
+    //        |                 |                      |
+    // (3)    |                 |           MHTMLGenerationManager::Job
+    //        |                 |           ::FinalizeOnFileThread
+    //        |                 |                      |
+    //        |                 |                      |
+    //        |            test needs to               |
+    //        |       disconnect message pipe          |
+    //        |       HERE - between (2) and (4)       |
+    //        |                 |                      |
+    //        |                 |                      |
+    //        |                 +<---------------------+
+    //        |                 |                      |
+    // (4)    |       MHTMLGenerationManager           |
+    //        |       Job::OnFinished                  |
+    //        |                 |                      |
     //
-    // We hope that the error handler is invoked between (1) and (3) by doing
+    // We ensure the disconnect handler is invoked between (2) and (4) by doing
     // the following:
     // - From here, run the callback response to the UI thread. This queues
     //   the response message onto the bound message pipe.
-    // - After running the callback response, immediately unbind the message
-    //   pipe in order to queue a message onto the bound message pipe to notify
-    //   the Browser the connection was closed and invoke the error handler.
-    // - Upon resuming operation, the FIFO ordering property of associated
-    //   interfaces guarantees the execution of (1) before the error handler.
-    //   (1) posts (2) to the download sequence and terminates. The client end
-    //   then accepts the error notification and invokes the connection error
-    //   handler, guaranteeing its execution before (3).
+    // - After running the callback response, we post a sequence of tasks to
+    //   the download thread (DelayDisconnectionStep1 -> Step2 -> Step3 ->
+    //   DisconnectMojoReceiver) to delay resetting the Mojo connection until
+    //   after the data pipe streaming has completed and DoneWritingToDisk (2)
+    //   has run on the UI thread.
+    // - Upon resuming operation, the FIFO ordering property of Mojo interfaces
+    //   guarantees that (1) executes before the error handler. In parallel,
+    //   the data pipe is drained, posting (2) which then posts (3). The client
+    //   end then accepts the error notification and invokes the connection
+    //   error handler, guaranteeing its execution before (4).
 
     bool compute_contents_hash = params->output_handle->is_producer_handle();
 
@@ -359,31 +362,39 @@
     // we must ensure the write complete notification arrives before the
     // connection error notification, otherwise the Browser will report
     // an MhtmlSaveStatus != kSuccess. We can guarantee this by potentially
-    // running tasks after each watcher invocation to send notifications that
-    // it has been completed. We need at least two tasks to guarantee this,
-    // as there can be at most two watcher invocations to write a block of
-    // data smaller than the data pipe buffer to file.
+    // running tasks sequentially on the download thread to delay the Mojo
+    // connection reset. We need three task hops on the download sequence to
+    // ensure that the reader has completed reading the EOF, and the completion
+    // task has been posted to the UI thread (DoneWritingToDisk) before the
+    // receiver is reset.
     download::GetDownloadTaskRunner()->PostTask(
         FROM_HERE,
-        base::BindOnce(&RespondAndDisconnectMockWriter::TaskX,
+        base::BindOnce(&RespondAndDisconnectMockWriter::DelayDisconnectionStep1,
                        scoped_refptr<RespondAndDisconnectMockWriter>(this)));
   }
 
-  void TaskX() {
+  void DelayDisconnectionStep1() {
     download::GetDownloadTaskRunner()->PostTask(
         FROM_HERE,
-        base::BindOnce(&RespondAndDisconnectMockWriter::TaskY,
+        base::BindOnce(&RespondAndDisconnectMockWriter::DelayDisconnectionStep2,
                        scoped_refptr<RespondAndDisconnectMockWriter>(this)));
   }
 
-  void TaskY() {
+  void DelayDisconnectionStep2() {
+    download::GetDownloadTaskRunner()->PostTask(
+        FROM_HERE,
+        base::BindOnce(&RespondAndDisconnectMockWriter::DelayDisconnectionStep3,
+                       scoped_refptr<RespondAndDisconnectMockWriter>(this)));
+  }
+
+  void DelayDisconnectionStep3() {
     GetUIThreadTaskRunner({})->PostTask(
         FROM_HERE,
-        base::BindOnce(&RespondAndDisconnectMockWriter::TaskZ,
+        base::BindOnce(&RespondAndDisconnectMockWriter::DisconnectMojoReceiver,
                        scoped_refptr<RespondAndDisconnectMockWriter>(this)));
   }
 
-  void TaskZ() { receiver_.reset(); }
+  void DisconnectMojoReceiver() { receiver_.reset(); }
 
  private:
   friend base::RefCountedThreadSafe<RespondAndDisconnectMockWriter>;