Check if Persistent owner thread matches pointer thread and current thread

third_party/WebKit/Source/platform/heap/Persistent.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef Persistent_h
 #define Persistent_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/Member.h"
 #include "platform/heap/PersistentNode.h"
@@ skipping 21 matching lines @@
     CrossThreadPersistentConfiguration
 };
 
 template<typename T, WeaknessPersistentConfiguration weaknessConfiguration, CrossThreadnessPersistentConfiguration crossThreadnessConfiguration>
 class PersistentBase {
     USING_FAST_MALLOC(PersistentBase);
     IS_PERSISTENT_REFERENCE_TYPE();
 public:
     PersistentBase() : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(std::nullptr_t) : m_raw(nullptr)
     {
+        saveCreationThreadHeap();
         initialize();
     }
 
     PersistentBase(T* raw) : m_raw(raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(T& raw) : m_raw(&raw)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(const PersistentBase& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     template<typename U>
     PersistentBase(const PersistentBase<U, weaknessConfiguration, crossThreadnessConfiguration>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     template<typename U>
     PersistentBase(const Member<U>& other) : m_raw(other)
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     PersistentBase(WTF::HashTableDeletedValueType) : m_raw(reinterpret_cast<T*>(-1))
     {
+        saveCreationThreadHeap();
         initialize();
         checkPointer();
     }
 
     ~PersistentBase()
     {
         uninitialize();
         m_raw = nullptr;
     }
 
@@ skipping 133 matching lines @@
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->checkThread());
         // Persistent handle must be created and destructed in the same thread.
         ASSERT(m_state == state);
         state->freePersistentNode(m_persistentNode);
         m_persistentNode = nullptr;
     }
 
     void checkPointer()
     {
-#if ENABLE(ASSERT) && defined(ADDRESS_SANITIZER)
+#if DCHECK_IS_ON()
         if (!m_raw || isHashTableDeletedValue())
             return;
 
+        if (crossThreadnessConfiguration != CrossThreadPersistentConfiguration && m_creationThreadHeap) {

[haraken, 2016/08/16 13:35:48]

I'm wondering if it's valid that m_creationThread is nullptr here.

+            ThreadState* current = ThreadState::current();
+            if (current && current->perThreadHeapEnabled()) {

[haraken, 2016/08/16 13:35:48]

What we really want to check is m_creationThreadHeap->perThreadHeapEnabled(),
right?

BTW, do we really need the check? I guess all cross-thread (non-CrossThread)
persistent handles should be removed immediately before enabling the per-thread
heap.

[keishi, 2016/08/17 09:48:57]

Mistake. Done.

+                DCHECK_EQ(&ThreadState::fromObject(m_raw)->heap(), m_creationThreadHeap);
+                DCHECK_EQ(&current->heap(), m_creationThreadHeap);
+            }
+        }
+
+#if defined(ADDRESS_SANITIZER)
         // ThreadHeap::isHeapObjectAlive(m_raw) checks that m_raw is a traceable
         // object. In other words, it checks that the pointer is either of:
         //
         //   (a) a pointer to the head of an on-heap object.
         //   (b) a pointer to the head of an on-heap mixin object.
         //
         // Otherwise, ThreadHeap::isHeapObjectAlive will crash when it calls
         // header->checkHeader().
         ThreadHeap::isHeapObjectAlive(m_raw);
 #endif
+#endif
+    }
+
+    void saveCreationThreadHeap()
+    {
+#if DCHECK_IS_ON()
+        if (ThreadState::current())

[haraken, 2016/08/16 13:35:48]

Is it possible that ThreadState::current() is nullptr for (non-cross-thread)
persistent handles?

[keishi, 2016/08/17 09:48:57]

We were creating Persistent(null) before ThreadState was attached.
WorkerBackingThread::initialize, V8PerIsolateData::initialize is called before
m_backingThread->initialize() so V8PerIsolateData::m_activeScriptWrappables is
created before the ThreadState is attached.
I changed the order so that doesn't happen.

Now Persistents always seem to be created with ThreadState::current(),
CrossThreadPersistents are still allocated on non attached threads and that
should be ok.

+            m_creationThreadHeap = &ThreadState::current()->heap();
+        else
+            m_creationThreadHeap = nullptr;
+#endif
     }
 
     static void handleWeakPersistent(Visitor* self, void* persistentPointer)
     {
         using Base = PersistentBase<typename std::remove_const<T>::type, weaknessConfiguration, crossThreadnessConfiguration>;
         Base* persistent = reinterpret_cast<Base*>(persistentPointer);
         T* object = persistent->get();
         if (object && !ObjectAliveTrait<T>::isHeapObjectAlive(object))
             persistent->clear();
     }
 
     // m_raw is accessed most, so put it at the first field.
     T* m_raw;
     PersistentNode* m_persistentNode = nullptr;
 #if ENABLE(ASSERT)
     ThreadState* m_state = nullptr;
 #endif
+#if DCHECK_IS_ON()
+    const ThreadHeap* m_creationThreadHeap;
+#endif
 };
 
 // Persistent is a way to create a strong pointer from an off-heap object
 // to another on-heap object. As long as the Persistent handle is alive
 // the GC will keep the object pointed to alive. The Persistent handle is
 // always a GC root from the point of view of the GC.
 //
 // We have to construct and destruct Persistent in the same thread.
 template<typename T>
 class Persistent : public PersistentBase<T, NonWeakPersistentConfiguration, SingleThreadPersistentConfiguration> {
@@ skipping 445 matching lines @@
 
 template <typename T>
 struct IsWeakReceiver<blink::WeakPersistent<T>> : std::true_type {};
 
 template <typename T>
 struct IsWeakReceiver<blink::CrossThreadWeakPersistent<T>> : std::true_type {};
 
 }
 
 #endif // Persistent_h