Oilpan: Disable lazy seeping for ImageLoaders

Source/core/loader/ImageLoader.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 44 matching lines @@
 class ImageLoader;
 class LayoutImageResource;
 
 template<typename T> class EventSender;
 typedef EventSender<ImageLoader> ImageEventSender;
 
 class CORE_EXPORT ImageLoader : public NoBaseWillBeGarbageCollectedFinalized<ImageLoader>, public ImageResourceClient {
 public:
     explicit ImageLoader(Element*);
     virtual ~ImageLoader();
+
+    // If we enable lazy sweeping for ImageLoader, ImageLoader::Task::run()
+    // can be scheduled for an ImageLoader that is about to die in the current
+    // lazy sweeping but has not yet swept. To avoid that from happening,
+    // disable lazy sweeping.
+    EAGERLY_FINALIZE();
     DECLARE_TRACE();
 
     enum UpdateFromElementBehavior {
         // This should be the update behavior when the element is attached to a document, or when DOM mutations trigger a new load.
         // Starts loading if a load hasn't already been started.
         UpdateNormal,
         // This should be the update behavior when the resource was changed (via 'src', 'srcset' or 'sizes').
         // Starts a new load even if a previous load of the same resource have failed, to match Firefox's behavior.
         // FIXME - Verify that this is the right behavior according to the spec.
         UpdateIgnorePreviousError,
@@ skipping 77 matching lines @@
     RawPtrWillBeMember<Element> m_element;
     ResourcePtr<ImageResource> m_image;
     // FIXME: Oilpan: We might be able to remove this Persistent hack when
     // ImageResourceClient is traceable.
     GC_PLUGIN_IGNORE("http://crbug.com/383741")
     RefPtrWillBePersistent<Element> m_keepAlive;
 #if ENABLE(OILPAN)
     class ImageLoaderClientRemover {
     public:
         ImageLoaderClientRemover(ImageLoader& loader, ImageLoaderClient& client) : m_loader(loader), m_client(client) { }
         ~ImageLoaderClientRemover();

[haraken, 2015/06/09 11:53:17]

Question: Who guarantees that m_loader is still alive when
~ImageLoaderClientRemover() runs?

 
     private:
         ImageLoader& m_loader;
         ImageLoaderClient& m_client;
     };
     friend class ImageLoaderClientRemover;
     // Oilpan: This ImageLoader object must outlive its clients because they

[haraken, 2015/06/09 11:53:17]

Now we have an eager sweep heap, but it seems not easy to fix this hack. To
remove the ImageLoaderClientRemover, we need to let ImageBitmap's destructor
touch the ImageLoader. However, we cannot achieve it by moving ImageBitmap to
the eager sweep heap, because the ImageLoader is already on the eager sweep
heap.

     // need to call ImageLoader::willRemoveClient before they
     // die. Non-Persistent HeapHashMap doesn't work well because weak processing
     // for HeapHashMap is not triggered when both of ImageLoader and
     // ImageLoaderClient are unreachable.
     GC_PLUGIN_IGNORE("http://crbug.com/383742")
     PersistentHeapHashMap<WeakMember<ImageLoaderClient>, OwnPtr<ImageLoaderClientRemover>> m_clients;
 #else
     HashSet<ImageLoaderClient*> m_clients;
 #endif
     Timer<ImageLoader> m_derefElementTimer;
     AtomicString m_failedLoadURL;
     WeakPtr<Task> m_pendingTask; // owned by Microtask
     OwnPtr<IncrementLoadEventDelayCount> m_loadDelayCounter;
     bool m_hasPendingLoadEvent : 1;
     bool m_hasPendingErrorEvent : 1;
     bool m_imageComplete : 1;
     bool m_loadingImageDocument : 1;
     bool m_elementIsProtected : 1;
     bool m_suppressErrorEvents : 1;
     unsigned m_highPriorityClientCount;
 };
 
 }
 
 #endif