WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 1928 matching lines @@
     m_entries[index] = cachePage;
 }
 
 void Heap::flushHeapDoesNotContainCache()
 {
     s_heapDoesNotContainCache->flush();
 }
 
 enum MarkingMode {
     GlobalMarking,
-    ThreadLocalMarking,
+    ThreadLocalMarking, // This works only if the thread is terminating.
+    ZombieMarking,
 };
 
 template <MarkingMode Mode>
 class MarkingVisitor final : public Visitor, public MarkingVisitorImpl<MarkingVisitor<Mode>> {
 public:
     using Impl = MarkingVisitorImpl<MarkingVisitor<Mode>>;
     friend class MarkingVisitorImpl<MarkingVisitor<Mode>>;
 
 #if ENABLE(GC_PROFILING)
     using LiveObjectSet = HashSet<uintptr_t>;
@@ skipping 158 matching lines @@
 #endif
 
 protected:
     virtual void registerWeakCellWithCallback(void** cell, WeakPointerCallback callback) override
     {
         Impl::registerWeakCellWithCallback(cell, callback);
     }
 
     inline bool shouldMarkObject(const void* objectPointer)
     {
-        if (Mode != ThreadLocalMarking)
+        if (Mode == GlobalMarking)
             return true;
 
-        BasePage* page = pageFromObject(objectPointer);
-        ASSERT(!page->orphaned());
-        // When doing a thread local GC, the marker checks if
-        // the object resides in another thread's heap. If it
-        // does, the object should not be marked & traced.
-        return page->terminating();
+        if (Mode == ThreadLocalMarking) {
+            BasePage* page = pageFromObject(objectPointer);
+            ASSERT(!page->orphaned());
+            // When doing a thread local GC, the marker checks if the object
+            // resides in another thread's heap. If it does, the object should
+            // not be marked & traced.
+            return page->terminating();
+        }
+
+        // ZombieMarking case.  Any objects must not be owned by other threads.
+        ASSERT(ThreadState::current()->findPageFromAddress(objectPointer));
+        return true;
     }
 
 #if ENABLE(ASSERT)
     virtual void checkMarkingAllowed() override
     {
         ASSERT(ThreadState::current()->isInGC());
     }
 #endif
 };
 
@@ skipping 322 matching lines @@
     if (Platform::current()) {
         Platform::current()->histogramCustomCounts("BlinkGC.CollectGarbage", WTF::currentTimeMS() - timeStamp, 0, 10 * 1000, 50);
         Platform::current()->histogramCustomCounts("BlinkGC.TotalObjectSpace", Heap::allocatedObjectSize() / 1024, 0, 4 * 1024 * 1024, 50);
         Platform::current()->histogramCustomCounts("BlinkGC.TotalAllocatedSpace", Heap::allocatedSpace() / 1024, 0, 4 * 1024 * 1024, 50);
     }
 
     if (state->isMainThread())
         ScriptForbiddenScope::exit();
 }
 
+void Heap::visitObjects(ThreadState* state, const HashSet<void*>& objects)
+{
+    MarkingVisitor<ZombieMarking> visitor;
+    ThreadState::NoAllocationScope noAllocationScope(state);
+    for (void* address : objects)
+        checkAndMarkPointer(&visitor, reinterpret_cast<Address>(address));
+    processMarkingStack(&visitor);
+    postMarkingProcessing(&visitor);
+    globalWeakProcessing(&visitor);
+}
+
 void Heap::collectGarbageForTerminatingThread(ThreadState* state)
 {
     // We explicitly do not enter a safepoint while doing thread specific
     // garbage collection since we don't want to allow a global GC at the
     // same time as a thread local GC.
     {
         MarkingVisitor<ThreadLocalMarking> markingVisitor;
         ThreadState::NoAllocationScope noAllocationScope(state);
 
         state->preGC();
@@ skipping 317 matching lines @@
 bool Heap::s_shutdownCalled = false;
 bool Heap::s_lastGCWasConservative = false;
 FreePagePool* Heap::s_freePagePool;
 OrphanedPagePool* Heap::s_orphanedPagePool;
 Heap::RegionTree* Heap::s_regionTree = nullptr;
 size_t Heap::s_allocatedObjectSize = 0;
 size_t Heap::s_allocatedSpace = 0;
 size_t Heap::s_markedObjectSize = 0;
 
 } // namespace blink