Oilpan: eagerly finalize WebGLRenderingContext objects.

Source/core/html/canvas/WebGLContextGroup.cpp

 /*
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 10 matching lines @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 
 #include "core/html/canvas/WebGLContextGroup.h"
 
 #include "core/html/canvas/WebGLSharedObject.h"
+#include "platform/heap/Handle.h"
 
 namespace blink {
 
 PassRefPtr<WebGLContextGroup> WebGLContextGroup::create()
 {
     RefPtr<WebGLContextGroup> contextGroup = adoptRef(new WebGLContextGroup());
     return contextGroup.release();
 }
 
 WebGLContextGroup::WebGLContextGroup()
 {
 }
 
 WebGLContextGroup::~WebGLContextGroup()
 {
     detachAndRemoveAllObjects();
 }
 
 WebGraphicsContext3D* WebGLContextGroup::getAWebGraphicsContext3D()
 {
     ASSERT(!m_contexts.isEmpty());
     HashSet<WebGLRenderingContextBase*>::iterator it = m_contexts.begin();
     return (*it)->webContext();
 }
 
+#if ENABLE(OILPAN) && defined(ADDRESS_SANITIZER)
+WebGLContextGroup::UnpoisonScope::UnpoisonScope(WebGLContextGroup* context)
+    : m_context(context)
+    , m_object(nullptr)
+{
+    m_context->poisonContext(false);
+}
+
+WebGLContextGroup::UnpoisonScope::UnpoisonScope(WebGLContextGroup* context, WebGLSharedObject* object)
+    : m_context(context)
+    , m_object(object)
+{
+    m_context->poisonObject(m_object, false);
+}
+
+WebGLContextGroup::UnpoisonScope::~UnpoisonScope()
+{
+    if (!m_object) {
+        m_context->poisonContext(true);
+    } else {
+        ASSERT(m_object);
+        m_context->poisonObject(m_object, true);
+    }
+}
+
+void WebGLContextGroup::poisonContext(bool poisonIt)
+{
+    HashSet<WebGLRenderingContextBase*>::iterator it = m_contexts.begin();

[haraken, 2015/05/26 11:23:10]

I'd prefer explicitly pass in the WebGLRenderingContextBase to be
poisoned/unpoisoned instead of looking up the first WebGLRenderingContextBase
from the m_contexts.

+    WebGLRenderingContextBase* context = *it;
+    if (!Heap::willObjectBeLazilySwept(context))

[haraken, 2015/05/26 11:23:10]

Can we replace this with Heap::isHeapObjectAlive()?

poisonContext must not be called for WebGLRenderingContextBases that have been
already finalized, because they should have been already removed from
m_contexts. Thus poisonContext can be called for either of:

(a) a live WebGLRenderingContextBase
(b) a dead WebGLRenderingContextBase that is not yet finalized

For (a), Heap::willObjectBeLazilySwept returns false. For (b),
Heap::willObjectBeLazilySwept returns true. I think you can get the same result
by calling Heap::isHeapObjectAlive(). Given that Heap::willObjectBeLazilySwept
is a super hacky API, I'd prefer using Heap::isHeapObjectAlive().

[sof, 2015/05/26 11:29:47]

I'm not sure what you refer to..what is Heap::isHeapObjectAlive() ?

[haraken, 2015/05/26 11:36:08]

Oh, you're right. isHeapObjectAlive() is available via Visitor... Then it makes
sense to use Heap::willObjectBeLazilySwept().

+        return;
+
+    unsigned char* objectStart = reinterpret_cast<unsigned char*>(context);
+    if (poisonIt)
+        ASAN_POISON_MEMORY_REGION(objectStart, sizeof(WebGLRenderingContextBase));
+    else
+        ASAN_UNPOISON_MEMORY_REGION(objectStart, sizeof(WebGLRenderingContextBase));
+}
+
+void WebGLContextGroup::poisonObject(WebGLSharedObject* object, bool poisonIt)
+{
+    if (!Heap::willObjectBeLazilySwept(object))

[haraken, 2015/05/26 11:23:10]

Ditto. I'd prefer using Heap::isHeapObjectAlive().

+        return;
+
+    unsigned char* objectStart = reinterpret_cast<unsigned char*>(object);
+    if (poisonIt)
+        ASAN_POISON_MEMORY_REGION(objectStart, sizeof(WebGLSharedObject));
+    else
+        ASAN_UNPOISON_MEMORY_REGION(objectStart, sizeof(WebGLSharedObject));
+}
+#endif
+
 void WebGLContextGroup::addContext(WebGLRenderingContextBase* context)
 {
     m_contexts.add(context);
 }
 
 void WebGLContextGroup::removeContext(WebGLRenderingContextBase* context)
 {
     // We must call detachAndRemoveAllObjects before removing the last context.
     if (m_contexts.size() == 1 && m_contexts.contains(context))
         detachAndRemoveAllObjects();
 
     m_contexts.remove(context);
 }
 
 void WebGLContextGroup::removeObject(WebGLSharedObject* object)
 {
     m_groupObjects.remove(object);
 }
 
 void WebGLContextGroup::addObject(WebGLSharedObject* object)
 {
     m_groupObjects.add(object);
 }
 
 void WebGLContextGroup::detachAndRemoveAllObjects()
 {
     while (!m_groupObjects.isEmpty()) {
         HashSet<WebGLSharedObject*>::iterator it = m_groupObjects.begin();
+#if ENABLE(OILPAN) && defined(ADDRESS_SANITIZER)
+        UnpoisonScope scope(this, *it);
+#endif
         (*it)->detachContextGroup();
     }
 }
 
 void WebGLContextGroup::loseContextGroup(WebGLRenderingContextBase::LostContextMode mode, WebGLRenderingContextBase::AutoRecoveryMethod autoRecoveryMethod)
 {
     // Detach must happen before loseContextImpl, which destroys the GraphicsContext3D
     // and prevents groupObjects from being properly deleted.
     detachAndRemoveAllObjects();
 
     for (WebGLRenderingContextBase* const context : m_contexts)
         context->loseContextImpl(mode, autoRecoveryMethod);
 }
 
 } // namespace blink