Clear out prefinalizer-allocated vector for conservative GC safety.

third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 43 matching lines @@
 void MediaStreamSource::setReadyState(ReadyState readyState) {
   if (m_readyState != ReadyStateEnded && m_readyState != readyState) {
     m_readyState = readyState;
 
     // Observers may dispatch events which create and add new Observers;
     // take a snapshot so as to safely iterate.
     HeapVector<Member<Observer>> observers;
     copyToVector(m_observers, observers);
     for (auto observer : observers)
       observer->sourceChangedState();
+
+    // setReadyState() will be invoked via the MediaStreamComponent::dispose()
+    // prefinalizer, allocating |observers|. Which means that |observers| will
+    // live until the next GC (but be unreferenced by other heap objects),
+    // _but_ it will potentially contain references to Observers that were
+    // GCed after the MediaStreamComponent prefinalizer had completed.
+    //
+    // So, if the next GC is a conservative one _and_ it happens to find
+    // a reference to |observers| when scanning the stack, we're in trouble
+    // as it contains references to now-dead objects.
+    //
+    // Work around this by explicitly clearing the vector backing store.
+    //
+    // TODO(sof): consider adding run-time checks that disallows this kind
+    // of dead object revivification by default.
+    for (size_t i = 0; i < observers.size(); ++i)
+      observers[i] = nullptr;
   }
 }
 
 void MediaStreamSource::addObserver(MediaStreamSource::Observer* observer) {
   m_observers.insert(observer);
 }
 
 void MediaStreamSource::addAudioConsumer(AudioDestinationConsumer* consumer) {
   ASSERT(m_requiresConsumer);
   MutexLocker locker(m_audioConsumersLock);
@@ skipping 28 matching lines @@
   MutexLocker locker(m_audioConsumersLock);
   for (AudioDestinationConsumer* consumer : m_audioConsumers)
     consumer->consumeAudio(bus, numberOfFrames);
 }
 
 DEFINE_TRACE(MediaStreamSource) {
   visitor->trace(m_observers);
 }
 
 }  // namespace blink