Move ResourceClient to Oilpan heap

third_party/WebKit/Source/core/fetch/Resource.cpp

 /*
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2006 Samuel Weinig (sam.weinig@gmail.com)
     Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
     License as published by the Free Software Foundation; either
@@ skipping 10 matching lines @@
     Boston, MA 02110-1301, USA.
 */
 
 #include "core/fetch/Resource.h"
 
 #include "core/fetch/CachedMetadata.h"
 #include "core/fetch/CrossOriginAccessControl.h"
 #include "core/fetch/FetchInitiatorTypeNames.h"
 #include "core/fetch/MemoryCache.h"
 #include "core/fetch/ResourceClient.h"
-#include "core/fetch/ResourceClientOrObserverWalker.h"
+#include "core/fetch/ResourceClientWalker.h"
 #include "core/fetch/ResourceLoader.h"
 #include "core/inspector/InstanceCounters.h"
 #include "platform/Histogram.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "platform/SharedBuffer.h"
 #include "platform/TraceEvent.h"
 #include "platform/network/HTTPParsers.h"
 #include "platform/weborigin/KURL.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCachePolicy.h"
@@ skipping 259 matching lines @@
     , m_overheadSize(calculateOverheadSize())
     , m_preloadCount(0)
     , m_preloadDiscoveryTime(0.0)
     , m_cacheIdentifier(MemoryCache::defaultCacheIdentifier())
     , m_preloadResult(PreloadNotReferenced)
     , m_type(type)
     , m_status(NotStarted)
     , m_needsSynchronousCacheHit(false)
     , m_linkPreload(false)
     , m_isRevalidating(false)
+    , m_isAlive(false)
     , m_options(options)
     , m_responseTimestamp(currentTime())
     , m_cancelTimer(this, &Resource::cancelTimerFired)
     , m_resourceRequest(request)
 {
     ASSERT(m_type == unsigned(type)); // m_type is a bitfield, so this tests careless updates of the enum.
     InstanceCounters::incrementCounter(InstanceCounters::ResourceCounter);
 
     // Currently we support the metadata caching only for HTTP family.
     if (m_resourceRequest.url().protocolIsInHTTPFamily())
         m_cacheHandler = CachedMetadataHandlerImpl::create(this);
 }
 
 Resource::~Resource()
 {
     InstanceCounters::decrementCounter(InstanceCounters::ResourceCounter);
 }
 
 DEFINE_TRACE(Resource)
 {
     visitor->trace(m_loader);
     visitor->trace(m_cacheHandler);
+    visitor->trace(m_clients);
+    visitor->trace(m_clientsAwaitingCallback);
+    visitor->trace(m_finishedClients);
 }
 
 void Resource::setLoader(ResourceLoader* loader)
 {
     RELEASE_ASSERT(!m_loader);
     ASSERT(stillNeedsLoad());
     m_loader = loader;
     m_status = Pending;
 }
 
@@ skipping 32 matching lines @@
 
 void Resource::setDataBufferingPolicy(DataBufferingPolicy dataBufferingPolicy)
 {
     m_options.dataBufferingPolicy = dataBufferingPolicy;
     m_data.clear();
     setEncodedSize(0);
 }
 
 void Resource::markClientsAndObserversFinished()
 {
-    HashCountedSet<ResourceClient*> clients;
+    HeapHashCountedSet<WeakMember<ResourceClient>> clients;
     m_clients.swap(clients);
     for (const auto& it : clients)
         m_finishedClients.add(it.key, it.value);
 }
 
 void Resource::error(const ResourceError& error)
 {
     ASSERT(!error.isNull());
     m_error = error;
     m_isRevalidating = false;
@@ skipping 288 matching lines @@
             m_preloadResult = PreloadReferencedWhileLoading;
         else
             m_preloadResult = PreloadReferenced;
 
         if (m_preloadDiscoveryTime) {
             int timeSinceDiscovery = static_cast<int>(1000 * (monotonicallyIncreasingTime() - m_preloadDiscoveryTime));
             DEFINE_STATIC_LOCAL(CustomCountHistogram, preloadDiscoveryHistogram, ("PreloadScanner.ReferenceTime", 0, 10000, 50));
             preloadDiscoveryHistogram.count(timeSinceDiscovery);
         }
     }
-    if (!hasClientsOrObservers())
+    if (!hasClientsOrObservers()) {
+        m_isAlive = true;
         memoryCache()->makeLive(this);
+    }
 }
 
 void Resource::addClient(ResourceClient* client)
 {
     willAddClientOrObserver();
 
     if (m_isRevalidating) {
         m_clients.add(client);
         return;
     }
 
     // If we have existing data to send to the new client and the resource type supprts it, send it asynchronously.
     if (!m_response.isNull() && !shouldSendCachedDataSynchronouslyForType(getType()) && !m_needsSynchronousCacheHit) {
         m_clientsAwaitingCallback.add(client);
         ResourceCallback::callbackHandler().schedule(this);
         return;
     }
 
     m_clients.add(client);
     didAddClient(client);
     return;
 }
 
 void Resource::removeClient(ResourceClient* client)
 {
-    ASSERT(hasClient(client));
+    if (!hasClient(client)) {

[haraken, 2016/08/18 08:06:17]

I begin to think this is problematic...

If Resource and ResoureClient die at the same time, the weak processing doesn't
run. However, pre-finalizer runs. Then hasClient() returns true and we end up
with executing line 734 - 744. Which should be problematic... :/

[yhirano, 2016/08/18 08:31:53]

Hmm, I did think the weak processing is executed in such a case...

Let me confirm, an entry |e| in a HeapVector<WeakMember<E>> |v| is cleared by
the weak processing when |e| is no longer reachable but |v| is still reachable,
is that correct?

[yhirano, 2016/08/18 08:53:15]

What problems do we have in such a case? I think L734-L739 (accessing
unreachable heap vectors in a prefinalizer) is safe to process and
didRemoveClientOrObserver is called in any case.

I'm not so sure about ResourceCallback::cancel but it looks consisting of
HeapHashSet operations and CancellableTaskFactory which is not related with
Oilpan.

[haraken, 2016/08/18 09:11:01]

Does it mean that it's always safe to run line 734 - 744 regardless of whether
we're in a pre-finalizer or not? Then maybe can we just simply the hasClient()
check entirely?

[yhirano, 2016/08/26 09:12:16]

Even without this change removeClient can be called in the pre-finalization
step. What this CL changes is that m_clients (and other heap collections) will
be swept automatically just before the pre-finalization step. L734-L744 is not
affected by the change because when |client| is swept this branch is taken.

[haraken, 2016/08/26 09:49:29]

My question is: Why do we need to have the branch at 727?

If Resource and ResourceClient die at the same time, the weak processing doesn't
run. Then the pre-finalizer will run line 734 - 744. Hence, line 734 - 744 must
be anyway written in a way that doesn't touch any other on-heap objects. If
that's the case, we can just unconditionally run line 734 - 744. Hence we don't
need the branch at 727.

[yhirano, 2016/08/26 10:08:55]

Because it's possible that a Resource is reachable but all ResourceClients
registered are unreachable and hence swept. Imagine a ResourceOwner |o| is
registered to a Resource |r| and the memory cache holds |r|. When |o| becomes
unreachable, this function will be called in |o|'s pre-finalizer, but |o| is
swept from |r->m_clients|. Note that |r| is still reachable via the memory
cache.

[haraken, 2016/08/26 10:19:51]

It will happen, but what's a problem of running line 734 - 744 then?

[yhirano, 2016/08/26 10:26:12]

Hm, I didn't think of that. It looks safe as HashCountedSet::remove is no-op in
such cases.

+        // This code may be called in a pre-finalizer, where weak members in the
+        // HashCountedSet are already swept out. In that case, we just need to
+        // call didRemoveClientOrObserver().
+        didRemoveClientOrObserver();
+        return;
+    }
     if (m_finishedClients.contains(client))
         m_finishedClients.remove(client);
     else if (m_clientsAwaitingCallback.contains(client))
         m_clientsAwaitingCallback.remove(client);
     else
         m_clients.remove(client);
 
     if (m_clientsAwaitingCallback.isEmpty())
         ResourceCallback::callbackHandler().cancel(this);
 
     didRemoveClientOrObserver();
-    // This object may be dead here.
 }
 
 void Resource::didRemoveClientOrObserver()
 {
-    if (!hasClientsOrObservers()) {
+    if (!hasClientsOrObservers() && m_isAlive) {
+        m_isAlive = false;
         memoryCache()->makeDead(this);
         allClientsAndObserversRemoved();
 
         // RFC2616 14.9.2:
         // "no-store: ... MUST make a best-effort attempt to remove the information from volatile storage as promptly as possible"
         // "... History buffers MAY store such responses as part of their normal operation."
         // We allow non-secure content to be reused in history, but we do not allow secure content to be reused.
         if (hasCacheControlNoStoreHeader() && url().protocolIs("https")) {
             memoryCache()->remove(this);
             memoryCache()->prune();
         } else {
             memoryCache()->prune(this);
         }
     }
     // This object may be dead here.

[haraken, 2016/08/18 09:11:01]

I think we can now remove this comment because Resource is no longer
ref-counted, right?

[yhirano, 2016/08/26 09:12:16]

Yes, there are many stale comments but I don't want to fix them in this CL.

 }
 
 void Resource::allClientsAndObserversRemoved()
 {
     if (!m_loader)
         return;
     if (m_type == Raw)
         cancelTimerFired(&m_cancelTimer);
     else if (!m_cancelTimer.isActive())
         m_cancelTimer.startOneShot(0, BLINK_FROM_HERE);
@@ skipping 37 matching lines @@
 {
     // We're going to notify clients one by one. It is simple if the client does nothing.
     // However there are a couple other things that can happen.
     //
     // 1. Clients can be added during the loop. Make sure they are not processed.
     // 2. Clients can be removed during the loop. Make sure they are always available to be
     //    removed. Also don't call removed clients or add them back.
 
     // Handle case (1) by saving a list of clients to notify. A separate list also ensure
     // a client is either in m_clients or m_clientsAwaitingCallback.
-    Vector<ResourceClient*> clientsToNotify;
+    HeapVector<Member<ResourceClient>> clientsToNotify;
     copyToVector(m_clientsAwaitingCallback, clientsToNotify);
 
     for (const auto& client : clientsToNotify) {
         // Handle case (2) to skip removed clients.
         if (!m_clientsAwaitingCallback.remove(client))
             continue;
         m_clients.add(client);
         didAddClient(client);
     }
 
@@ skipping 289 matching lines @@
     case Resource::TextTrack:
     case Resource::Media:
     case Resource::Manifest:
         return false;
     }
     ASSERT_NOT_REACHED();
     return false;
 }
 
 } // namespace blink