Wrap GCed raw pointer parameters of WTF::bind with Persistent

third_party/WebKit/Source/modules/webdatabase/DatabaseThread.cpp

 /*
  * Copyright (C) 2007, 2008, 2013 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 96 matching lines @@
     if (m_openDatabaseSet.size() > 0) {
         // As the call to close will modify the original set, we must take a copy to iterate over.
         HashSet<CrossThreadPersistent<Database>> openSetCopy;
         openSetCopy.swap(m_openDatabaseSet);
         HashSet<CrossThreadPersistent<Database>>::iterator end = openSetCopy.end();
         for (HashSet<CrossThreadPersistent<Database>>::iterator it = openSetCopy.begin(); it != end; ++it)
             (*it)->close();
     }
     m_openDatabaseSet.clear();
 
-    m_thread->postTask(BLINK_FROM_HERE, WTF::bind(&DatabaseThread::cleanupDatabaseThreadCompleted, this));
+    m_thread->postTask(BLINK_FROM_HERE, WTF::bind(&DatabaseThread::cleanupDatabaseThreadCompleted, wrapCrossThreadPersistent(this)));

[sof, 2016/06/22 09:39:22]

Isn't this happening on the same thread?

[tzik, 2016/06/22 10:16:01]

Yes, this task is posted to the same thread.
However, we need to use CrossThread here, since |this| is created on the main
thread and posted to the database thread.

[sof, 2016/06/22 13:24:27]

A Persistent<> is allowed to contain a reference to an object in another
thread's heap -- it only must be created & destroyed on the same thread. Which I
think will hold here + be a simpler rule to follow. Or did you discover
otherwise?

[tzik, 2016/06/22 13:56:51]

That's true on other threads than DatabaseThread.
According to keishi@, DatabaseThread recently starts using per-thread heap. That
requires all references from foreign threads to be CrossThread, so that GC
system can find it.

[sof, 2016/06/22 14:06:50]

If that's the case, how would |this| be discovered as a root for a main thread
GC while (e.g.) this method (cleanupDatabaseThread()) is executed by the
database thread?

 }
 
 void DatabaseThread::cleanupDatabaseThreadCompleted()
 {
     m_thread->shutdown();
     if (m_cleanupSync) // Someone wanted to know when we were done cleaning up.
         m_cleanupSync->taskCompleted();
 }
 
 void DatabaseThread::recordDatabaseOpen(Database* database)
@@ skipping 41 matching lines @@
     {
         MutexLocker lock(m_terminationRequestedMutex);
         ASSERT(!m_terminationRequested);
     }
 #endif
     // WebThread takes ownership of the task.
     m_thread->postTask(BLINK_FROM_HERE, threadSafeBind(&DatabaseTask::run, std::move(task)));
 }
 
 } // namespace blink