Oilpan: have media element prefinalizer handle all finalization.

Source/core/html/HTMLMediaElement.cpp

 /*
  * Copyright (C) 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 339 matching lines @@
     , m_sentStalledEvent(false)
     , m_sentEndEvent(false)
     , m_closedCaptionsVisible(false)
     , m_completelyLoaded(false)
     , m_havePreparedToPlay(false)
     , m_tracksAreReady(true)
     , m_haveVisibleTextTrack(false)
     , m_processingPreferenceChange(false)
     , m_remoteRoutesAvailable(false)
     , m_playingRemotely(false)
+    , m_isFinalizing(false)
 #if ENABLE(OILPAN)
-    , m_isFinalizing(false)
     , m_closeMediaSourceWhenFinalizing(false)
 #endif
     , m_initialPlayWithoutUserGestures(false)
     , m_autoplayMediaCounted(false)
     , m_audioTracks(AudioTrackList::create(*this))
     , m_videoTracks(VideoTrackList::create(*this))
     , m_textTracks(nullptr)
 #if ENABLE(WEB_AUDIO)
     , m_audioSourceNode(nullptr)
 #endif
 {
 #if ENABLE(OILPAN)
     ThreadState::current()->registerPreFinalizer(*this);
 #endif
     ASSERT(RuntimeEnabledFeatures::mediaEnabled());
 
     WTF_LOG(Media, "HTMLMediaElement::HTMLMediaElement(%p)", this);
 
     if (document.settings() && document.settings()->mediaPlaybackRequiresUserGesture())
         m_userGestureRequiredForPlay = true;
 
     setHasCustomStyleCallbacks();
     addElementToDocumentMap(this, &document);
 }
 
 HTMLMediaElement::~HTMLMediaElement()
 {
     WTF_LOG(Media, "HTMLMediaElement::~HTMLMediaElement(%p)", this);
-
-#if ENABLE(OILPAN)
-    if (m_closeMediaSourceWhenFinalizing)
-        closeMediaSource();
-
-    // Oilpan: the player must be released, but the player object
-    // cannot safely access this player client any longer as parts of
-    // it may have been finalized already (like the media element's
-    // supplementable table.)  Handled for now by entering an
-    // is-finalizing state, which is explicitly checked for if the
-    // player tries to access the media element during shutdown.
-    //
-    // FIXME: Oilpan: move the media player to the heap instead and
-    // avoid having to finalize it from here; this whole #if block
-    // could then be removed (along with the state bit it depends on.)
-    // crbug.com/378229
-    m_isFinalizing = true;
-#else
+#if !ENABLE(OILPAN)
     // HTMLMediaElement and m_asyncEventQueue always become unreachable
     // together. So HTMLMediaElement and m_asyncEventQueue are destructed in
     // the same GC. We don't need to close it explicitly in Oilpan.
     m_asyncEventQueue->close();
 
     setShouldDelayLoadEvent(false);
 
     if (m_textTracks)
         m_textTracks->clearOwner();
     m_audioTracks->shutdown();
     m_videoTracks->shutdown();
 
     if (m_mediaController) {
         m_mediaController->removeMediaElement(this);
         m_mediaController = nullptr;
     }
     closeMediaSource();
 
     removeElementFromDocumentMap(this, &document());
-#endif
 
     // Destroying the player may cause a resource load to be canceled,
     // which could result in userCancelledLoad() being called back.
-    // Setting m_completelyLoaded ensures that such a call will not cause
+    // Setting m_isFinalizing ensures that such a call will not cause
     // us to dispatch an abort event, which would result in a crash.
     // See http://crbug.com/233654 for more details.
-    m_completelyLoaded = true;
+    m_isFinalizing = true;
 
-    // With Oilpan load events on the Document are always delayed during
-    // sweeping so we don't need to explicitly increment and decrement
-    // load event delay counts.
-#if !ENABLE(OILPAN)
     // Destroying the player may cause a resource load to be canceled,
     // which could result in Document::dispatchWindowLoadEvent() being
     // called via ResourceFetch::didLoadResource() then
     // FrameLoader::checkCompleted(). To prevent load event dispatching during
     // object destruction, we use Document::incrementLoadEventDelayCount().
     // See http://crbug.com/275223 for more details.
     document().incrementLoadEventDelayCount();
+
+    clearMediaPlayerAndAudioSourceProviderClientWithoutLocking();
+
+    document().decrementLoadEventDelayCount();
 #endif
 
+#if ENABLE(WEB_AUDIO)
     // m_audioSourceNode is explicitly cleared by AudioNode::dispose().
     // Since AudioNode::dispose() is guaranteed to be always called before
     // the AudioNode is destructed, m_audioSourceNode is explicitly cleared
     // even if the AudioNode and the HTMLMediaElement die together.
-#if ENABLE(WEB_AUDIO)
     ASSERT(!m_audioSourceNode);
 #endif
-    clearMediaPlayerAndAudioSourceProviderClientWithoutLocking();
-
-#if !ENABLE(OILPAN)
-    document().decrementLoadEventDelayCount();
-#endif
 }
 
 #if ENABLE(OILPAN)
 void HTMLMediaElement::dispose()
 {
     // If the HTMLMediaElement dies with the Document we are not
     // allowed to touch the Document to adjust delay load event counts
     // from the destructor, as the Document could have been already
     // destructed.
     //
     // Work around that restriction by accessing the Document from
     // a prefinalizer action instead, updating its delayed load count.
     // If needed - if the Document has been detached and informed its
     // ContextLifecycleObservers (which HTMLMediaElement is) that
     // it is being destroyed, the connection to the Document will
     // have been severed already, but in that case there is no need
     // to update the delayed load count. But if the Document hasn't
     // been detached cleanly from any frame or it isn't dying in the
     // same GC, we do update the delayed load count from the prefinalizer.
     if (ActiveDOMObject::executionContext())
         setShouldDelayLoadEvent(false);
+
+    if (m_closeMediaSourceWhenFinalizing)

[haraken, 2015/06/22 13:25:40]

Maybe can we remove m_closeMediaSourceWhenFinalizing? I guess we can
unconditionally call closeMediaSource() since the MediaSource is guaranteed to
be alive at this point (during the finalizer).

[sof, 2015/06/22 13:31:56]

I would prefer not to, as it would call MediaSource::close() on a dying object.

[haraken, 2015/06/22 13:43:36]

Makes sense; Then would it be a bit tidier to directly check
isHeapObjectAlive(m_mediaSource) and decide to call closeMediaSource or not?

+        closeMediaSource();
+
+    // Oilpan: the player must be released, but the player object
+    // cannot safely access this player client any longer as parts of
+    // it may have been finalized already (like the media element's
+    // supplementable table.)  Handled for now by entering an
+    // is-finalizing state, which is explicitly checked for if the
+    // player tries to access the media element during shutdown.
+    //
+    // FIXME: Oilpan: move the media player to the heap instead and
+    // avoid having to finalize it from here; this whole #if block
+    // could then be removed (along with the state bit it depends on.)
+    // crbug.com/378229
+    m_isFinalizing = true;
+
+    clearMediaPlayerAndAudioSourceProviderClientWithoutLocking();
 }
 
 void HTMLMediaElement::setCloseMediaSourceWhenFinalizing()
 {
     ASSERT(!m_closeMediaSourceWhenFinalizing);
     m_closeMediaSourceWhenFinalizing = true;
 }
 #endif
 
 void HTMLMediaElement::didMoveToNewDocument(Document& oldDocument)
@@ skipping 2497 matching lines @@
 
 void HTMLMediaElement::userCancelledLoad()
 {
     WTF_LOG(Media, "HTMLMediaElement::userCancelledLoad(%p)", this);
 
     // If the media data fetching process is aborted by the user:
 
     // 1 - The user agent should cancel the fetching process.
     clearMediaPlayer(-1);
 
-    if (m_networkState == NETWORK_EMPTY || m_completelyLoaded)
+    if (m_networkState == NETWORK_EMPTY || m_completelyLoaded || m_isFinalizing)
         return;
 
     // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
 
     // 3 - Queue a task to fire a simple event named error at the media element.
     scheduleEvent(EventTypeNames::abort);
 
     closeMediaSource();
 
@@ skipping 670 matching lines @@
 
 #if ENABLE(WEB_AUDIO)
 void HTMLMediaElement::clearWeakMembers(Visitor* visitor)
 {
     if (!Heap::isHeapObjectAlive(m_audioSourceNode) && audioSourceProvider())
         audioSourceProvider()->setClient(nullptr);
 }
 #endif
 
 }