Invalidate cross-thread persistents on heap termination.

Source/platform/heap/PersistentNode.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef PersistentNode_h
 #define PersistentNode_h
 
 #include "platform/PlatformExport.h"
 #include "platform/heap/ThreadState.h"
 #include "wtf/Assertions.h"
@@ skipping 26 matching lines @@
 
     // Ideally the trace method should be virtual and automatically dispatch
     // to the most specific implementation. However having a virtual method
     // on PersistentNode leads to too eager template instantiation with MSVC
     // which leads to include cycles.
     // Instead we call the constructor with a TraceCallback which knows the
     // type of the most specific child and calls trace directly. See
     // TraceMethodDelegate in Visitor.h for how this is done.
     void tracePersistentNode(Visitor* visitor)
     {
+        ASSERT(isValid());
         ASSERT(!isUnused());
         ASSERT(m_trace);
         m_trace(visitor, m_self);
     }
 
     void initialize(void* self, TraceCallback trace)
     {
         ASSERT(isUnused());
         m_self = self;
         m_trace = trace;
@@ skipping 13 matching lines @@
         PersistentNode* node = reinterpret_cast<PersistentNode*>(m_self);
         ASSERT(!node || node->isUnused());
         return node;
     }
 
     bool isUnused() const
     {
         return !m_trace;
     }
 
+    bool isValid() const
+    {
+        return !(reinterpret_cast<uintptr_t>(m_self) & 0x1);
+    }
+
+    void invalidate()
+    {
+        m_self = reinterpret_cast<Address>(reinterpret_cast<uintptr_t>(m_self) | 0x1);

[haraken, 2015/08/03 00:45:25]

Or I'd prefer just clearing the pointer. The semantics will be:

- CrossThreadPersistent can outlive the thread that has allocated the pointing
object. The outlived CrossThreadPersistent is cleared out when the owner thread
gets detached.

[sof, 2015/08/03 08:30:04]

Can do that instead, that is, clear out the underlying raw pointer of the m_self
here.

+    }
+
+    void* self() const
+    {
+        return m_self;
+    }
+
 private:
     // If this PersistentNode is in use:
     //   - m_self points to the corresponding Persistent handle.
     //   - m_trace points to the trace method.
     // If this PersistentNode is freed:
     //   - m_self points to the next freed PersistentNode.
     //   - m_trace is nullptr.
     void* m_self;
     TraceCallback m_trace;
 };
 
 struct PersistentNodeSlots final {
 private:
     static const int slotCount = 256;
     PersistentNodeSlots* m_next;
     PersistentNode m_slot[slotCount];
     friend class PersistentRegion;
+    friend class CrossThreadPersistentRegion;
 };
 
 // PersistentRegion provides a region of PersistentNodes. PersistentRegion
 // holds a linked list of PersistentNodeSlots, each of which stores
 // a predefined number of PersistentNodes. You can call allocatePersistentNode/
 // freePersistentNode to allocate/free a PersistentNode on the region.
 class PLATFORM_EXPORT PersistentRegion final {
 public:
     PersistentRegion()
         : m_freeListHead(nullptr)
@@ skipping 25 matching lines @@
         persistentNode->setFreeListNext(m_freeListHead);
         m_freeListHead = persistentNode;
 #if ENABLE(ASSERT)
         --m_persistentCount;
 #endif
     }
     void tracePersistentNodes(Visitor*);
     int numberOfPersistents();
 
 private:
+    friend CrossThreadPersistentRegion;
+
     void ensurePersistentNodeSlots(void*, TraceCallback);
 
     PersistentNode* m_freeListHead;
     PersistentNodeSlots* m_slots;
 #if ENABLE(ASSERT)
     int m_persistentCount;
 #endif
 };
 
 class CrossThreadPersistentRegion final {
@@ skipping 11 matching lines @@
         MutexLocker lock(m_mutex);
         m_persistentRegion->freePersistentNode(persistentNode);
     }
 
     void tracePersistentNodes(Visitor* visitor)
     {
         MutexLocker lock(m_mutex);
         m_persistentRegion->tracePersistentNodes(visitor);
     }
 
+    void prepareForThreadStateTermination(ThreadState*);
+
 private:
     // We don't make CrossThreadPersistentRegion inherit from PersistentRegion
     // because we don't want to virtualize performance-sensitive methods
     // such as PersistentRegion::allocate/freePersistentNode.
     OwnPtr<PersistentRegion> m_persistentRegion;
     Mutex m_mutex;
 };
 
 } // namespace blink
 
 #endif