Oilpan: Add support of pre-finalization callback to Oilpan infrastructure.

Source/platform/heap/ThreadState.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef ThreadState_h
 #define ThreadState_h
 
 #include "platform/PlatformExport.h"
 #include "platform/heap/AddressSanitizer.h"
 #include "public/platform/WebThread.h"
+#include "wtf/HashMap.h"
 #include "wtf/HashSet.h"
 #include "wtf/OwnPtr.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/ThreadSpecific.h"
 #include "wtf/Threading.h"
 #include "wtf/ThreadingPrimitives.h"
 #include "wtf/Vector.h"
 
-#if ENABLE(GC_PROFILE_HEAP)
-#include "wtf/HashMap.h"
-#endif
-
 namespace blink {
 
 class BaseHeap;
 class BaseHeapPage;
 class FinalizedHeapObjectHeader;
 struct GCInfo;
 class HeapContainsCache;
 class HeapObjectHeader;
 class PageMemory;
 class PersistentNode;
@@ skipping 65 matching lines @@
         class Class;                                                    \
     }                                                                   \
     namespace blink {                                                 \
         template<> struct ThreadingTrait<Namespace::Class> {            \
             static const ThreadAffinity Affinity = AnyThread;           \
         };                                                              \
     }
 
 template<typename U> class ThreadingTrait<const U> : public ThreadingTrait<U> { };
 
+// Declare that a class has a pre-finalizer function.  The function is called in
+// the object's owner thread, and can access Member<>s to other
+// garbarge-collected objects allocated in the thread.  However we must not
+// allocate new garbage-collected objects, nor must update Member<> and
+// Persistent<> pointers.

[haraken, 2014/10/06 05:26:42]

nor must update => nor update

(I'm not familiar with the usage of 'nor', but the safest way to say this would
be: we must not allocate ... nor update ....)

+//
+// This feature is similar to the HeapHashMap<WeakMember<Foo>, OwnPtr<Disposer>>
+// idiom.  The difference between this and the idiom is that pre-finalizer
+// function is called whenever an object is destructed with this feature.  With
+// the HeapHashMap<WeakMember...> idiom, a Disposer object is not destructed
+// before the corresponding ~Foo if the Foo object and the onwer of the
+// HeapHashMap are collected at same time.

[haraken, 2014/10/06 05:26:42]

I'm a bit confused with this description.

class Bar : public GarbageCollected<Bar> {
  HeapHashMap<WeakMember<Foo>, OwnPtr<Disposer>> m_map;
};

If the Bar object and the Foo objects become unreachable at the same time, the
Disposer's destructors won't be called at all, will it? More accurately, if the
Bar object becomes unreachable, the Disposer's destructors won't be called at
all.

Thus we cannot use the idiom if we want to have Foo::dispose called whenever the
Foo object becomes unreachable. If we want to do that, we need to use the
pre-finalizer.

Am I understanding correctly?

[tkent, 2014/10/06 06:02:24]

It's not correct.  ~Disposer is called when a backing store of HeapHashMap is
swept. If ~Foo is called before ~Disposer, this causes a use-after-free.
In order to avoid UAF, we need an assumption, or need to make it
PersistentHeapHashMap.  e.g. AudioContext::m_liveNodes is safe because
AudioContext always outlives any AudioNodes.
Right.

[haraken, 2014/10/06 06:28:09]

Thanks, understood.

Then is the only difference whether it is guaranteed that ~Disposer() gets
called before ~Foo()?

I begin to think that from the perspective of GC overhead, there is no
difference between the HeapHashMap<WeakMember...> idiom and the pre-finalizer.
If so, we should probably aim at replacing all the HeapHashMap<WeakMember...>
idioms with the pre-finalizers. What do you think?

[tkent, 2014/10/06 07:00:52]

Right.  Both of them have O(n) cost, and the pre-finalizer is much easier to
use. We can replace existing usage of HeapHashMap<WeakMember<>,
OwnPtr<Disposer>> idiom.

[haraken, 2014/10/06 07:04:09]

Sounds great. Then let's replace this comment with a FIXME and mention that the
HeapHashMap<WeakMember<>, ...> idiom should be replaced with the pre-finalizer
idiom?

[tkent, 2014/10/06 07:17:59]

Done.  Added a FIXME.

+//
+// See ThreadState::registerPreFinalizer.
+//
+// Usage:
+//
+// class Foo : GarbageCollected<Foo> {
+//     USING_PRE_FINALIZER(Foo, dispose);
+// public:
+//     Foo()
+//     {
+//         registerPreFinalizer();

[haraken, 2014/10/06 05:26:42]

registerPreFinalizer(*this);

+//     }
+// private:
+//     void dispose();
+//     Member<Bar> m_bar;
+// };
+//
+// void Foo::dispose()
+// {
+//     m_bar->...
+// }
+#define USING_PRE_FINALIZER(Class, method)   \
+    public: \
+        static bool invokePreFinalizer(void* object, Visitor& visitor)   \
+        { \
+            Class* self = reinterpret_cast<Class*>(object); \
+            if (visitor.isAlive(self)) \
+                return false; \
+            self->method(); \
+            return true; \
+        } \
+        typedef char UsingPreFinazlizerMacroNeedsTrailingSemiColon
+
 // List of typed heaps. The list is used to generate the implementation
 // of typed heap related methods.
 //
 // To create a new typed heap add a H(<ClassName>) to the
 // FOR_EACH_TYPED_HEAP macro below.
 #define FOR_EACH_TYPED_HEAP(H)  \
     H(Node)
 
 #define TypedHeapEnumName(Type) Type##Heap,
 #define TypedHeapEnumNameNonFinalized(Type) Type##HeapNonFinalized,
@@ skipping 478 matching lines @@
 
     void getStats(HeapStats&);
     HeapStats& stats() { return m_stats; }
     HeapStats& statsAfterLastGC() { return m_statsAfterLastGC; }
 
     void setupHeapsForTermination();
 
     void registerSweepingTask();
     void unregisterSweepingTask();
 
+    // Request to call a pref-finalizer of the target object before the object
+    // is destructed.  The class T must have USING_PRE_FINALIZER().  The
+    // argument should be |*this|.  Registering a lot of objects affects GC
+    // performance.  We should register an object only if the object really
+    // requires pre-finalizer, and we should unregister the object if
+    // pre-finalizer is unnecessary.
+    template<typename T>
+    void registerPreFinalizer(T& target)
+    {
+        ASSERT(!m_preFinalizers.contains(&target));
+        ASSERT(!isSweepInProgress());
+        m_preFinalizers.add(&target, &T::invokePreFinalizer);
+    }
+
+    // Cancel above requests.  The argument should be |*this|.  This function is
+    // ignored if it is called in pre-finalizer functions.
+    template<typename T>
+    void unregisterPreFinalizer(T& target)
+    {
+        ASSERT(&T::invokePreFinalizer);
+        unregisterPreFinalizerInternal(&target);
+    }
+
     Mutex& sweepMutex() { return m_sweepMutex; }
 
 private:
     explicit ThreadState();
     ~ThreadState();
 
     friend class SafePointBarrier;
     friend class SafePointAwareMutexLocker;
 
     void enterSafePoint(StackState, void*);
@@ skipping 18 matching lines @@
     // to sweep away any objects that are left on this heap.
     // We assert that nothing must remain after this cleanup.
     // If assertion does not hold we crash as we are potentially
     // in the dangling pointer situation.
     void cleanup();
     void cleanupPages();
 
     void setLowCollectionRate(bool value) { m_lowCollectionRate = value; }
 
     void waitUntilSweepersDone();
+    void unregisterPreFinalizerInternal(void*);
+    void invokePreFinalizers(Visitor&);
 
     static WTF::ThreadSpecific<ThreadState*>* s_threadSpecific;
     static SafePointBarrier* s_safePointBarrier;
 
     // This variable is flipped to true after all threads are stoped
     // and outermost GC has started.
     static bool s_inGC;
 
     // We can't create a static member of type ThreadState here
     // because it will introduce global constructor and destructor.
@@ skipping 31 matching lines @@
     bool m_isTerminating;
 
     bool m_lowCollectionRate;
 
     OwnPtr<blink::WebThread> m_sweeperThread;
     int m_numberOfSweeperTasks;
     Mutex m_sweepMutex;
     ThreadCondition m_sweepThreadCondition;
 
     CallbackStack* m_weakCallbackStack;
+    HashMap<void*, bool (*)(void*, Visitor&)> m_preFinalizers;
 
 #if defined(ADDRESS_SANITIZER)
     void* m_asanFakeStack;
 #endif
 };
 
 template<ThreadAffinity affinity> class ThreadStateFor;
 
 template<> class ThreadStateFor<MainThreadOnly> {
 public:
@@ skipping 116 matching lines @@
     // whether the page is part of a terminting thread or
     // if the page is traced after being terminated (orphaned).
     uintptr_t m_terminating : 1;
     uintptr_t m_tracedAfterOrphaned : 1;
     uintptr_t m_promptlyFreedSize : 17; // == blinkPageSizeLog2
 };
 
 }
 
 #endif // ThreadState_h