Lazily constructed bespoke cancellable timer task.

Source/platform/Timer.h

Index: Source/platform/Timer.h
diff --git a/Source/platform/Timer.h b/Source/platform/Timer.h
index 60fec18a6b0356eff0326002f44bd70d8b777ba1..d5981e772583ea4c65736980b893026b94725301 100644
--- a/Source/platform/Timer.h
+++ b/Source/platform/Timer.h
@@ -28,7 +28,6 @@
 
 #include "platform/PlatformExport.h"
 #include "platform/heap/Handle.h"
-#include "platform/scheduler/CancellableTaskFactory.h"
 #include "public/platform/WebTraceLocation.h"
 #include "wtf/AddressSanitizer.h"
 #include "wtf/Noncopyable.h"
@@ -72,11 +71,6 @@ public:
 
     void didChangeAlignmentInterval(double now);
 
-#if defined(ADDRESS_SANITIZER)
-protected:
-    CancellableTaskFactory& cancellableTaskFactory() { return m_cancellableTaskFactory; }
-#endif
-
 private:
     virtual void fired() = 0;
 
@@ -87,13 +81,37 @@ private:
 
     void setNextFireTime(double now, double delay);
 
-    void run();
+    void runInternal();
+
+    class CancellableTimerTask final : public WebThread::Task {
+        WTF_MAKE_NONCOPYABLE(CancellableTimerTask);
+    public:
+        explicit CancellableTimerTask(TimerBase* timer) : m_timer(timer) { }
+
+        ~CancellableTimerTask() override { }

[sof, 2015/06/26 06:45:06]

I guess this needs to clear out m_timer's back reference ?

+
+        void run() override
+        {
+            if (m_timer) {
+                m_timer->m_cancellableTimerTask = nullptr;
+                m_timer->runInternal();
+            }
+        }
+
+        void cancel()
+        {
+            m_timer = nullptr;
+        }
+
+    private:
+        TimerBase* m_timer; // NOT OWNED
+    };
 
     double m_nextFireTime; // 0 if inactive
     double m_unalignedNextFireTime; // m_nextFireTime not considering alignment interval
     double m_repeatInterval; // 0 if not repeating
     WebTraceLocation m_location;
-    CancellableTaskFactory m_cancellableTaskFactory;
+    CancellableTimerTask* m_cancellableTimerTask; // NOT OWNED
     WebScheduler* m_webScheduler; // Not owned.
 
 #if ENABLE(ASSERT)
@@ -128,10 +146,6 @@ public:
     Timer(TimerFiredClass* o, TimerFiredFunction f)
         : m_object(o), m_function(f)
     {
-#if ENABLE(LAZY_SWEEPING) && defined(ADDRESS_SANITIZER)

[sof, 2015/06/25 14:03:42]

Looks like not replacing this with an alternative caused an Oilpan ASan
meltdown,


http://build.chromium.org/p/chromium.webkit/builders/WebKit%20Linux%20Oilpan%...

-        if (IsGarbageCollectedType<TimerFiredClass>::value)
-            cancellableTaskFactory().setUnpoisonBeforeUpdate();
-#endif
     }
 
 protected:
@@ -162,7 +176,7 @@ NO_LAZY_SWEEP_SANITIZE_ADDRESS
 inline bool TimerBase::isActive() const
 {
     ASSERT(m_thread == currentThread());
-    return m_cancellableTaskFactory.isPending();
+    return m_cancellableTimerTask;
 }
 
 } // namespace blink