WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/modules/webaudio/AudioContext.h

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 61 matching lines @@
 class ScriptProcessorNode;
 class ScriptPromiseResolver;
 class ScriptState;
 class SecurityOrigin;
 class StereoPannerNode;
 class WaveShaperNode;
 
 // AudioContext is the cornerstone of the web audio API and all AudioNodes are created from it.
 // For thread safety between the audio thread and the main thread, it has a rendering graph locking mechanism.
 
-class AudioContext : public RefCountedGarbageCollectedEventTargetWithInlineData<AudioContext>, public ActiveDOMObject {
+class AudioContext
+    : public RefCountedGarbageCollectedEventTargetWithInlineData<AudioContext>
+    , public ActiveDOMObject
+    , private ThreadState::MarkingTask {
     DEFINE_EVENT_TARGET_REFCOUNTING_WILL_BE_REMOVED(RefCountedGarbageCollected<AudioContext>);
     WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(AudioContext);
     DEFINE_WRAPPERTYPEINFO();
 public:
     // The state of an audio context.  On creation, the state is Suspended. The state is Running if
     // audio is being processed (audio graph is being pulled for data). The state is Closed if the
     // audio context has been closed.  The valid transitions are from Suspended to either Running or
     // Closed; Running to Suspended or Closed. Once Closed, there are no valid transitions.
     enum AudioContextState {
         Suspended,
         Running,
         Closed
     };
 
     // Create an AudioContext for rendering to the audio hardware.
     static AudioContext* create(Document&, ExceptionState&);
 
     virtual ~AudioContext();
 
     DECLARE_VIRTUAL_TRACE();
 
     bool isInitialized() const { return m_isInitialized; }
     bool isOfflineContext() { return m_isOfflineContext; }
+    AudioContextState contextState() const { return m_contextState; }
+    void setLastZombie(void*);
 
     // Document notification
     virtual void stop() override final;
     virtual bool hasPendingActivity() const override;
 
     AudioDestinationNode* destination() { return m_destinationNode.get(); }
 
     size_t currentSampleFrame() const { return m_destinationNode ? m_destinationNode->currentSampleFrame() : 0; }
     double currentTime() const { return m_destinationNode ? m_destinationNode->currentTime() : 0; }
     // cachedSampleFrame() is like currentSampleFrame() but must be called from the main thread to
@@ skipping 167 matching lines @@
 
 protected:
     explicit AudioContext(Document*);
     AudioContext(Document*, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate);
 
     RefPtrWillBeMember<ScriptPromiseResolver> m_offlineResolver;
 private:
     void initialize();
     void uninitialize();
 
+    // ThreadState::MarkingTask functions.
+    void willStartMarking(ThreadState&) override;
+    void didFinishMarking(ThreadState&) override;
+
     // ExecutionContext calls stop twice.
     // We'd like to schedule only one stop action for them.
     bool m_isStopScheduled;
     bool m_isCleared;
     void clear();
 
     void throwExceptionForClosedState(ExceptionState&);
 
     // Set to true when the destination node has been initialized and is ready to process data.
     bool m_isInitialized;
@@ skipping 89 matching lines @@
     // m_automaticPullNodesNeedUpdating keeps track if m_automaticPullNodes is modified.
     bool m_automaticPullNodesNeedUpdating;
     void updateAutomaticPullNodes();
 
     unsigned m_connectionCount;
 
     // Graph locking.
     bool m_didInitializeContextGraphMutex;
     RecursiveMutex m_contextGraphMutex;
     volatile ThreadIdentifier m_audioThread;
+    // Accessing m_last*Zombie should be protected by
+    // m_didInitializeContextGraphMutex.
+    void* m_lastZombie;
+    void* m_lastRemovableZombie;
 
     // Only accessed in the audio thread.
     // Oilpan: Since items are added to these vectors by the audio thread (not registered to Oilpan),
     // we cannot use HeapVectors.
     GC_PLUGIN_IGNORE("http://crbug.com/404527")
     Vector<AudioNode*> m_deferredBreakConnectionList;
 
     Member<AudioBuffer> m_renderTarget;
 
     bool m_isOfflineContext;
@@ skipping 23 matching lines @@
     // This is considering 32 is large enough for multiple channels audio.
     // It is somewhat arbitrary and could be increased if necessary.
     enum { MaxNumberOfChannels = 32 };
 
     unsigned m_contextId;
 };
 
 } // namespace blink
 
 #endif // AudioContext_h