Web Audio: Oilpan: Correctly trace m_referencedNodes elements within a lock.

Source/modules/webaudio/AudioContext.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 88 matching lines @@
 // Constructor for rendering to the audio hardware.
 AudioContext::AudioContext(Document* document)
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
+    , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
     , m_isOfflineContext(false)
     , m_contextState(Suspended)
 {
-    m_referencedNodes = new HeapVector<Member<AudioNode>>();
+    m_didInitializeContextGraphMutex = true;
     m_destinationNode = DefaultAudioDestinationNode::create(this);
 
     initialize();
 #if DEBUG_AUDIONODE_REFERENCES
     fprintf(stderr, "%p: AudioContext::AudioContext() #%u\n", this, AudioContext::s_hardwareContextCount);
 #endif
 }
 
 // Constructor for offline (non-realtime) rendering.
 AudioContext::AudioContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
+    , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
     , m_isOfflineContext(true)
     , m_contextState(Suspended)
 {
-    m_referencedNodes = new HeapVector<Member<AudioNode>>();
+    m_didInitializeContextGraphMutex = true;
     // Create a new destination for offline rendering.
     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
     if (m_renderTarget.get())
         m_destinationNode = OfflineAudioDestinationNode::create(this, m_renderTarget.get());
 
     initialize();
 }
 
 AudioContext::~AudioContext()
 {
 #if DEBUG_AUDIONODE_REFERENCES
     fprintf(stderr, "%p: AudioContext::~AudioContext()\n", this);
 #endif
     // AudioNodes keep a reference to their context, so there should be no way to be in the destructor if there are still AudioNodes around.
     ASSERT(!m_isInitialized);
+    ASSERT(!m_referencedNodes.size());
     ASSERT(!m_finishedNodes.size());
     ASSERT(!m_automaticPullNodes.size());
     if (m_automaticPullNodesNeedUpdating)
         m_renderingAutomaticPullNodes.resize(m_automaticPullNodes.size());
     ASSERT(!m_renderingAutomaticPullNodes.size());
     ASSERT(!m_suspendResolvers.size());
     ASSERT(!m_resumeResolvers.size());
 }
 
 void AudioContext::initialize()
@@ skipping 509 matching lines @@
         derefNode(m_finishedNodes[i]);
 
     m_finishedNodes.clear();
 }
 
 void AudioContext::refNode(AudioNode* node)
 {
     ASSERT(isMainThread());
     AutoLocker locker(this);
 
-    m_referencedNodes->append(node);
+    m_referencedNodes.append(node);
     node->makeConnection();
 }
 
 void AudioContext::derefNode(AudioNode* node)
 {
     ASSERT(isGraphOwner());
 
-    for (unsigned i = 0; i < m_referencedNodes->size(); ++i) {
-        if (node == m_referencedNodes->at(i).get()) {
+    for (unsigned i = 0; i < m_referencedNodes.size(); ++i) {
+        if (node == m_referencedNodes.at(i).get()) {
             node->breakConnection();
-            m_referencedNodes->remove(i);
+            m_referencedNodes.remove(i);
             break;
         }
     }
 }
 
 void AudioContext::derefUnfinishedSourceNodes()
 {
     ASSERT(isMainThread());
-    for (unsigned i = 0; i < m_referencedNodes->size(); ++i)
-        m_referencedNodes->at(i)->breakConnection();
+    for (unsigned i = 0; i < m_referencedNodes.size(); ++i)
+        m_referencedNodes.at(i)->breakConnection();
 
-    m_referencedNodes->clear();
+    m_referencedNodes.clear();
 }
 
 void AudioContext::lock()
 {
     // Don't allow regular lock in real-time audio thread.
     ASSERT(isMainThread());
     m_contextGraphMutex.lock();
 }
 
 bool AudioContext::tryLock()
@@ skipping 356 matching lines @@
         dispatchEvent(OfflineAudioCompletionEvent::create(renderedBuffer));
     }
 }
 
 void AudioContext::trace(Visitor* visitor)
 {
     visitor->trace(m_renderTarget);
     visitor->trace(m_destinationNode);
     visitor->trace(m_listener);
     // trace() can be called in AudioContext constructor, and
-    // m_contextGraphMutex might be unavailable.  We can use m_contextGraphMutex
-    // if m_referencedNodes is not null because m_referencedNodes is initialized
-    // after m_contextGraphMutex.
-    if (m_referencedNodes) {
+    // m_contextGraphMutex might be unavailable.
+    if (m_didInitializeContextGraphMutex) {
         AutoLocker lock(this);
         visitor->trace(m_referencedNodes);
+    } else {
+        visitor->trace(m_referencedNodes);
     }
     visitor->trace(m_liveNodes);
     visitor->trace(m_liveAudioSummingJunctions);
     EventTargetWithInlineData::trace(visitor);
 }
 
 void AudioContext::addChangedChannelCountMode(AudioNode* node)
 {
     ASSERT(isGraphOwner());
     ASSERT(isMainThread());
@@ skipping 13 matching lines @@
 
     for (HashSet<AudioNode*>::iterator k = m_deferredCountModeChange.begin(); k != m_deferredCountModeChange.end(); ++k)
         (*k)->updateChannelCountMode();
 
     m_deferredCountModeChange.clear();
 }
 
 } // namespace blink
 
 #endif // ENABLE(WEB_AUDIO)