Avoid unsafe heap access from audio thread.

third_party/WebKit/Source/platform/heap/ThreadState.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 302 matching lines @@
     explicit GCForbiddenScope(ThreadState* thread_state)
         : thread_state_(thread_state) {
       thread_state_->EnterGCForbiddenScope();
     }
     ~GCForbiddenScope() { thread_state_->LeaveGCForbiddenScope(); }
 
    private:
     ThreadState* const thread_state_;
   };
 
+  // Per-thread lock that's held while a GC runs; can be
+  // used by non-attached threads to safely coordinate access
+  // to the heap while it is in a non-GCing state.

[hongchan, 2017/06/01 16:08:55]

From what I understand, this should not be abused and the general policy should
be applied for most cases. (i.e. don't touch other threads' objects.)

Perhaps we need some warnings here?

+  class GCLockScope final {
+    STACK_ALLOCATED();
+
+   public:
+    explicit GCLockScope(ThreadState* thread_state)
+        : thread_state_(thread_state) {
+      thread_state_->active_gc_mutex_.lock();
+    }
+    ~GCLockScope() { thread_state_->active_gc_mutex_.unlock(); }
+
+   private:
+    ThreadState* const thread_state_;
+  };
+
   void FlushHeapDoesNotContainCacheIfNeeded();
 
   // Safepoint related functionality.
   //
   // When a thread attempts to perform GC it needs to stop all other threads
   // that use the heap or at least guarantee that they will not touch any
   // heap allocated object until GC is complete.
   //
   // We say that a thread is at a safepoint if this thread is guaranteed to
   // not touch any heap allocated object or any heap related functionality until
@@ skipping 289 matching lines @@
   void InvokePreFinalizers();
 
   void TakeSnapshot(SnapshotType);
   void ClearArenaAges();
   int ArenaIndexOfVectorArenaLeastRecentlyExpanded(int begin_arena_index,
                                                    int end_arena_index);
 
   void ReportMemoryToV8();
 
   friend class SafePointScope;
+  friend class GCLockScope;
 
   static WTF::ThreadSpecific<ThreadState*>* thread_specific_;
 
   // We can't create a static member of type ThreadState here
   // because it will introduce global constructor and destructor.
   // We would like to manage lifetime of the ThreadState attached
   // to the main thread explicitly instead and still use normal
   // constructor and destructor for the ThreadState class.
   // For this we reserve static storage for the main ThreadState
   // and lazily construct ThreadState in it using placement new.
   static uint8_t main_thread_state_storage_[];
 
   std::unique_ptr<ThreadHeap> heap_;
   ThreadIdentifier thread_;
   std::unique_ptr<PersistentRegion> persistent_region_;
   BlinkGC::StackState stack_state_;
   intptr_t* start_of_stack_;
   intptr_t* end_of_stack_;
 
   void* safe_point_scope_marker_;
   Vector<Address> safe_point_stack_copy_;
   bool sweep_forbidden_;
   size_t no_allocation_count_;
   size_t gc_forbidden_count_;
   size_t mixins_being_constructed_count_;
   double accumulated_sweeping_time_;
   bool object_resurrection_forbidden_;
+  Mutex active_gc_mutex_;
 
   BaseArena* arenas_[BlinkGC::kNumberOfArenas];
   int vector_backing_arena_index_;
   size_t arena_ages_[BlinkGC::kNumberOfArenas];
   size_t current_arena_ages_;
 
   GarbageCollectedMixinConstructorMarker* gc_mixin_marker_;
 
   bool should_flush_heap_does_not_contain_cache_;
   GCState gc_state_;
@@ skipping 60 matching lines @@
 class ThreadStateFor<kAnyThread> {
   STATIC_ONLY(ThreadStateFor);
 
  public:
   static ThreadState* GetState() { return ThreadState::Current(); }
 };
 
 }  // namespace blink
 
 #endif  // ThreadState_h