WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/modules/webaudio/AudioContext.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 93 matching lines @@
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
     , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
+    , m_lastZombie(nullptr)
+    , m_lastRemovableZombie(nullptr)
     , m_isOfflineContext(false)
     , m_contextState(Suspended)
     , m_cachedSampleFrame(0)
 {
     m_didInitializeContextGraphMutex = true;
     m_destinationNode = DefaultAudioDestinationNode::create(this);
 
     initialize();
 }
 
 // Constructor for offline (non-realtime) rendering.
 AudioContext::AudioContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
     , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
+    , m_lastZombie(nullptr)
+    , m_lastRemovableZombie(nullptr)
     , m_isOfflineContext(true)
     , m_contextState(Suspended)
     , m_cachedSampleFrame(0)
 {
     m_didInitializeContextGraphMutex = true;
     // Create a new destination for offline rendering.
     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
     if (m_renderTarget.get())
         m_destinationNode = OfflineAudioDestinationNode::create(this, m_renderTarget.get());
 
@@ skipping 16 matching lines @@
     ASSERT(!m_suspendResolvers.size());
     ASSERT(!m_isResolvingResumePromises);
     ASSERT(!m_resumeResolvers.size());
 }
 
 void AudioContext::initialize()
 {
     if (isInitialized())
         return;
 
+    ThreadState::current()->addMarkingTask(this);
     FFTFrame::initialize();
     m_listener = AudioListener::create();
 
     if (m_destinationNode.get()) {
         m_destinationNode->initialize();
 
         if (!isOfflineContext()) {
             // This starts the audio thread. The destination node's provideInput() method will now be called repeatedly to render audio.
             // Each time provideInput() is called, a portion of the audio stream is rendered. Let's call this time period a "render quantum".
             // NOTE: for now default AudioContext does not need an explicit startRendering() call from JavaScript.
@@ skipping 50 matching lines @@
         setContextState(Closed);
 
     // Resolve the promise now, if any
     if (m_closeResolver)
         m_closeResolver->resolve();
 
     ASSERT(m_listener);
     m_listener->waitForHRTFDatabaseLoaderThreadCompletion();
 
     clear();
+
+    ThreadState::current()->removeMarkingTask(this);
+    if (m_lastZombie)
+        ThreadState::current()->purifyZombies();
+    m_lastZombie = nullptr;
+    m_lastRemovableZombie = nullptr;
 }
 
 void AudioContext::stop()
 {
     // Usually ExecutionContext calls stop twice.
     if (m_isStopScheduled)
         return;
     m_isStopScheduled = true;
 
     // Don't call uninitialize() immediately here because the ExecutionContext is in the middle
@@ skipping 726 matching lines @@
     if (tryLock()) {
         // Update the channel count mode.
         updateChangedChannelCountMode();
 
         // Take care of AudioNode tasks where the tryLock() failed previously.
         handleDeferredAudioNodeTasks();
 
         // Dynamically clean up nodes which are no longer needed.
         derefFinishedSourceNodes();
 
+        m_lastRemovableZombie = m_lastZombie;
+
         // Fixup the state of any dirty AudioSummingJunctions and AudioNodeOutputs.
         handleDirtyAudioSummingJunctions();
         handleDirtyAudioNodeOutputs();
 
         updateAutomaticPullNodes();
         resolvePromisesForSuspend();
 
         unlock();
     }
 }
@@ skipping 276 matching lines @@
     }
 }
 
 DEFINE_TRACE(AudioContext)
 {
     visitor->trace(m_closeResolver);
     visitor->trace(m_offlineResolver);
     visitor->trace(m_renderTarget);
     visitor->trace(m_destinationNode);
     visitor->trace(m_listener);
-    // trace() can be called in AudioContext constructor, and
-    // m_contextGraphMutex might be unavailable.
-    if (m_didInitializeContextGraphMutex) {
-        AutoLocker lock(this);
-        visitor->trace(m_referencedNodes);
-    } else {
-        visitor->trace(m_referencedNodes);
-    }
+    visitor->trace(m_referencedNodes);
     visitor->trace(m_resumeResolvers);
     visitor->trace(m_suspendResolvers);
     visitor->trace(m_liveNodes);
     visitor->trace(m_liveAudioSummingJunctions);
     RefCountedGarbageCollectedEventTargetWithInlineData<AudioContext>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 void AudioContext::addChangedChannelCountMode(AudioNode* node)
 {
@@ skipping 56 matching lines @@
 
     // Stop the audio context. This will stop the destination node from pulling audio anymore. And
     // since we have disconnected the destination from the audio graph, and thus has no references,
     // the destination node can GCed if JS has no references. stop() will also resolve the Promise
     // created here.
     stop();
 
     return promise;
 }
 
+void AudioContext::setLastZombie(void* object)
+{
+    ASSERT(isGraphOwner());
+    m_lastZombie = object;
+}
+
+void AudioContext::willStartMarking(ThreadState& threadState)
+{
+    lock();
+    if (!m_lastRemovableZombie)
+        return;
+    if (m_lastZombie != m_lastRemovableZombie)
+        return;
+    threadState.purifyZombies();
+    m_lastZombie = nullptr;
+    m_lastRemovableZombie = nullptr;
+}
+
+void AudioContext::didFinishMarking(ThreadState&)
+{
+    unlock();
+}
+
 } // namespace blink
 
 #endif // ENABLE(WEB_AUDIO)