Oilpan: add prefinalizer for HTMLMediaElement.

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 350 matching lines @@
 #endif
     , m_initialPlayWithoutUserGestures(false)
     , m_autoplayMediaCounted(false)
     , m_audioTracks(AudioTrackList::create(*this))
     , m_videoTracks(VideoTrackList::create(*this))
     , m_textTracks(nullptr)
 #if ENABLE(WEB_AUDIO)
     , m_audioSourceNode(nullptr)
 #endif
 {
+#if ENABLE(OILPAN)
+    ThreadState::current()->registerPreFinalizer(*this);
+#endif
     ASSERT(RuntimeEnabledFeatures::mediaEnabled());
 
     WTF_LOG(Media, "HTMLMediaElement::HTMLMediaElement(%p)", this);
 
     if (document.settings() && document.settings()->mediaPlaybackRequiresUserGesture())
         m_userGestureRequiredForPlay = true;
 
     setHasCustomStyleCallbacks();
     addElementToDocumentMap(this, &document);
 }
 
 HTMLMediaElement::~HTMLMediaElement()
 {
     WTF_LOG(Media, "HTMLMediaElement::~HTMLMediaElement(%p)", this);
 
 #if ENABLE(OILPAN)
-    // If the HTMLMediaElement dies with the document we are not
-    // allowed to touch the document to adjust delay load event counts
-    // because the document could have been already
-    // destructed. However, if the HTMLMediaElement dies with the
-    // document there is no need to change the delayed load counts
-    // because no load event will fire anyway. If the document is
-    // still alive we do have to decrement the load delay counts. We
-    // determine if the document is alive via the ActiveDOMObject
-    // which is a context lifecycle observer. If the Document has been
-    // destructed ActiveDOMObject::executionContext() returns 0.
-    if (ActiveDOMObject::executionContext())
-        setShouldDelayLoadEvent(false);
+    if (m_closeMediaSourceWhenFinalizing)

[haraken, 2015/06/17 20:29:02]

I guess this hack could be moved to the pre-finalizer as well, but we can do
this in a follow-up.

[sof, 2015/06/17 20:40:46]

I don't think it can be, as it allocates & fires an event.

[haraken, 2015/06/17 20:47:15]

Allocation is allowed in pre-finalizers.

closeMediaSource schedules an event (i.e., MediaSource::onReadyStateChange
enqueues an event) but it doesn't dispatch the event in closeMediaSource. (If it
does, it would be already problematic because it's dangerous to dispatch an
event in a destructor.)

+        closeMediaSource();
+
+    // Oilpan: the player must be released, but the player object
+    // cannot safely access this player client any longer as parts of
+    // it may have been finalized already (like the media element's
+    // supplementable table.)  Handled for now by entering an
+    // is-finalizing state, which is explicitly checked for if the
+    // player tries to access the media element during shutdown.
+    //
+    // FIXME: Oilpan: move the media player to the heap instead and
+    // avoid having to finalize it from here; this whole #if block
+    // could then be removed (along with the state bit it depends on.)
+    // crbug.com/378229
+    m_isFinalizing = true;
 #else
     // HTMLMediaElement and m_asyncEventQueue always become unreachable
-    // together. So HTMLMediaElemenet and m_asyncEventQueue are destructed in
+    // together. So HTMLMediaElement and m_asyncEventQueue are destructed in
     // the same GC. We don't need to close it explicitly in Oilpan.
     m_asyncEventQueue->close();
 
     setShouldDelayLoadEvent(false);
 
     if (m_textTracks)
         m_textTracks->clearOwner();
     m_audioTracks->shutdown();
     m_videoTracks->shutdown();
 
     if (m_mediaController) {
         m_mediaController->removeMediaElement(this);
         m_mediaController = nullptr;
     }
-#endif
-
-#if ENABLE(OILPAN)
-    if (m_closeMediaSourceWhenFinalizing)
-        closeMediaSource();
-#else
     closeMediaSource();
 
     removeElementFromDocumentMap(this, &document());
 #endif
 
     // Destroying the player may cause a resource load to be canceled,
     // which could result in userCancelledLoad() being called back.
     // Setting m_completelyLoaded ensures that such a call will not cause
     // us to dispatch an abort event, which would result in a crash.
     // See http://crbug.com/233654 for more details.
     m_completelyLoaded = true;
 
     // With Oilpan load events on the Document are always delayed during
     // sweeping so we don't need to explicitly increment and decrement
     // load event delay counts.
 #if !ENABLE(OILPAN)
     // Destroying the player may cause a resource load to be canceled,
     // which could result in Document::dispatchWindowLoadEvent() being
     // called via ResourceFetch::didLoadResource() then
     // FrameLoader::checkCompleted(). To prevent load event dispatching during
     // object destruction, we use Document::incrementLoadEventDelayCount().
     // See http://crbug.com/275223 for more details.
     document().incrementLoadEventDelayCount();
 #endif
 
-#if ENABLE(OILPAN)
-    // Oilpan: the player must be released, but the player object
-    // cannot safely access this player client any longer as parts of
-    // it may have been finalized already (like the media element's
-    // supplementable table.)  Handled for now by entering an
-    // is-finalizing state, which is explicitly checked for if the
-    // player tries to access the media element during shutdown.
-    //
-    // FIXME: Oilpan: move the media player to the heap instead and
-    // avoid having to finalize it from here; this whole #if block
-    // could then be removed (along with the state bit it depends on.)
-    // crbug.com/378229
-    m_isFinalizing = true;
-#endif
-
     // m_audioSourceNode is explicitly cleared by AudioNode::dispose().
     // Since AudioNode::dispose() is guaranteed to be always called before
     // the AudioNode is destructed, m_audioSourceNode is explicitly cleared
     // even if the AudioNode and the HTMLMediaElement die together.
 #if ENABLE(WEB_AUDIO)
     ASSERT(!m_audioSourceNode);
 #endif
     clearMediaPlayerAndAudioSourceProviderClientWithoutLocking();
 
 #if !ENABLE(OILPAN)
     document().decrementLoadEventDelayCount();
 #endif
 }
 
 #if ENABLE(OILPAN)
+void HTMLMediaElement::dispose()
+{
+    // If the HTMLMediaElement dies with the Document we are not
+    // allowed to touch the Document to adjust delay load event counts
+    // from the destructor, as the Document could have been already
+    // destructed.
+    //
+    // Work around that restriction by accessing the Document from
+    // a prefinalizer action instead, updating its delayed load count.
+    // If needed - if the Document has been detached and informed its
+    // ContextLifecycleObservers (which HTMLMediaElement is) that
+    // it is being destroyed, the connection to the Document will
+    // have been severed already, but in that case there is no need
+    // to update the delayed load count. But if the Document hasn't
+    // been detached cleanly from any frame or it isn't dying in the
+    // same GC, we do update the delayed load count from the prefinalizer.
+    if (ActiveDOMObject::executionContext())
+        setShouldDelayLoadEvent(false);
+}
+
 void HTMLMediaElement::setCloseMediaSourceWhenFinalizing()
 {
     ASSERT(!m_closeMediaSourceWhenFinalizing);
     m_closeMediaSourceWhenFinalizing = true;
 }
 #endif
 
 void HTMLMediaElement::didMoveToNewDocument(Document& oldDocument)
 {
     WTF_LOG(Media, "HTMLMediaElement::didMoveToNewDocument(%p)", this);
@@ skipping 3180 matching lines @@
 
 #if ENABLE(WEB_AUDIO)
 void HTMLMediaElement::clearWeakMembers(Visitor* visitor)
 {
     if (!Heap::isHeapObjectAlive(m_audioSourceNode) && audioSourceProvider())
         audioSourceProvider()->setClient(nullptr);
 }
 #endif
 
 }