Create MediaValuesCached and TokenPreloadScanner on the parser thread

third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp

Index: third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
diff --git a/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp b/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
index ce7ae53ee92cb75360850659490e93faa9c2471a..bd84b305306ae63e3d71c760acb147795e1541b8 100644
--- a/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
+++ b/third_party/WebKit/Source/core/html/parser/HTMLDocumentParser.cpp
@@ -687,9 +687,11 @@ void HTMLDocumentParser::pumpTokenizer()
         // adding paranoia if for speculative crash fix for crbug.com/465478
         if (m_preloader) {
             if (!m_preloadScanner) {
-                m_preloadScanner = adoptPtr(new HTMLPreloadScanner(m_options,
+                m_preloadScanner = HTMLPreloadScanner::create(
+                    m_options,
                     document()->url(),
-                    CachedDocumentParameters::create(document())));
+                    CachedDocumentParameters::create(document()),
+                    MediaValuesCached::MediaValuesCachedData(*document()));
                 m_preloadScanner->appendToEnd(m_input.current());
             }
             m_preloadScanner->scan(m_preloader.get(), document()->baseElementURL());
@@ -771,9 +773,11 @@ void HTMLDocumentParser::insert(const SegmentedString& source)
         // Check the document.write() output with a separate preload scanner as
         // the main scanner can't deal with insertions.
         if (!m_insertionPreloadScanner) {
-            m_insertionPreloadScanner = adoptPtr(new HTMLPreloadScanner(m_options,
+            m_insertionPreloadScanner = HTMLPreloadScanner::create(
+                m_options,
                 document()->url(),
-                CachedDocumentParameters::create(document())));
+                CachedDocumentParameters::create(document()),
+                MediaValuesCached::MediaValuesCachedData(*document()));
         }
 
         m_insertionPreloadScanner->appendToEnd(source);
@@ -810,7 +814,6 @@ void HTMLDocumentParser::startBackgroundParser()
     config->xssAuditor = adoptPtr(new XSSAuditor);
     config->xssAuditor->init(document(), &m_xssAuditorDelegate);
 
-    config->preloadScanner = adoptPtr(new TokenPreloadScanner(document()->url().copy(), CachedDocumentParameters::create(document())));
     config->decoder = takeDecoder();
     config->parsedChunkQueue = m_parsedChunkQueue.get();
     if (document()->settings()) {
@@ -821,8 +824,13 @@ void HTMLDocumentParser::startBackgroundParser()
     }
 
     ASSERT(config->xssAuditor->isSafeToSendToAnotherThread());
-    ASSERT(config->preloadScanner->isSafeToSendToAnotherThread());
-    HTMLParserThread::shared()->postTask(threadSafeBind(&BackgroundHTMLParser::start, reference.release(), config.release(),
+    HTMLParserThread::shared()->postTask(threadSafeBind(
+        &BackgroundHTMLParser::start,
+        reference.release(),
+        config.release(),
+        document()->url(),
+        CachedDocumentParameters::create(document()),

[Yoav Weiss, 2016/02/01 09:29:30]

Isn't that racy? IIUC (and it's fairly possible I might not be...)
CachedDocumentParameters::create(document()) and
MediaValuesCachedData(*document()) are run in the context of the background
thread, which means that we're passing document() over.

At least in theory, I don't think that's safe.

[hiroshige, 2016/02/01 09:42:10]

I think:
1. HTMLDocumentParser::startBackgroundParser() is called on the main thread.
2. CachedDocumentParameters::create(document()) and
MediaValuesCachedData(*document()) are also executed on the main thread.
3. Results of Step 2 is processed by CrossThreadCopier, and passed across
threads.
4. BackgroundHTMLParser::start() is executed on the background parser thread.

Because Step 2. is executed on the main thread, I expect this is safe.

+        MediaValuesCached::MediaValuesCachedData(*document()),
         adoptPtr(m_loadingTaskRunner->clone())));
 }