Clear out prefinalizer-allocated vector for conservative GC safety.

third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp

Index: third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp
diff --git a/third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp b/third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp
index 79485a8d4989a5457b2b396d089fd757a61b617a..8b64be54ef6ef674b44373889609afb9ef893f26 100644
--- a/third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp
+++ b/third_party/WebKit/Source/platform/mediastream/MediaStreamSource.cpp
@@ -61,6 +61,20 @@ void MediaStreamSource::setReadyState(ReadyState readyState) {
     copyToVector(m_observers, observers);
     for (auto observer : observers)
       observer->sourceChangedState();
+
+    // setReadyState() will be invoked via the MediaStreamComponent::dispose(),
+    // prefinalizer, allocating |observers|. Which means that |observers| will
+    // live until the next/ GC (but be unreferenced by other heap objects),

[haraken, 2017/03/24 04:58:43]

next

+    // _but_ it will potentially contain references to Observers that were
+    // GCed after the MediaStreamComponent prefinalizer had completed.
+    //
+    // So, if the next GC is a conservative one _and_ it happens to find
+    // a reference to |observers| when scanning the stack, we're in trouble
+    // as it contains references to now-dead objects.
+    //
+    // Work around this by explicitly clearing the vector backing store.
+    for (size_t i = 0; i < observers.size(); ++i)

[haraken, 2017/03/24 04:58:43]

Can we just call observers.clear()?

[sof, 2017/03/24 05:03:25]

We need to clear the backing store contents, not what points to it.

+        observers[i] = nullptr;
   }
 }