WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/platform/heap/ThreadState.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 458 matching lines @@
     }
 
     // Should only be called under protection of threadAttachMutex().
     const Vector<Interruptor*>& interruptors() const { return m_interruptors; }
 
     void recordStackEnd(intptr_t* endOfStack)
     {
         m_endOfStack = endOfStack;
     }
 
+    // MarkingTask functions are called before and after marking live objects.
+    // They might be called on threads other than the thread associated to this
+    // ThreadState.
+    class MarkingTask {
+    public:
+        virtual ~MarkingTask() { }
+        virtual void willStartMarking(ThreadState&) { }
+        virtual void didFinishMarking(ThreadState&) { }
+    };
+    // A caller is responsible to call removeMarkingTask before deleting the
+    // specified task.
+    void addMarkingTask(MarkingTask*);
+    void removeMarkingTask(MarkingTask*);
+
     // Get one of the heap structures for this thread.
     //
     // The heap is split into multiple heap parts based on object
     // types. To get the index for a given type, use
     // HeapIndexTrait<Type>::index.
     BaseHeap* heap(int heapIndex) const { return m_heaps[heapIndex]; }
 
 #if ENABLE(ASSERT) || ENABLE(GC_PROFILING)
     // Infrastructure to determine if an address is within one of the
     // address ranges for the Blink heap. If the address is in the Blink
     // heap the containing heap page is returned.
     BasePage* findPageFromAddress(Address);
-    BasePage* findPageFromAddress(void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(pointer)); }
+    BasePage* findPageFromAddress(const void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(const_cast<void*>(pointer))); }
 #endif
 
     // List of persistent roots allocated on the given thread.
     PersistentNode* roots() const { return m_persistents.get(); }
 
     // List of global persistent roots not owned by any particular thread.
     // globalRootsMutex must be acquired before any modifications.
     static PersistentNode& globalRoots();
     static Mutex& globalRootsMutex();
 
@@ skipping 73 matching lines @@
     // Cancel above requests.  The argument should be |*this|.  This function is
     // ignored if it is called in pre-finalizer functions.
     template<typename T>
     void unregisterPreFinalizer(T& target)
     {
         checkThread();
         ASSERT(&T::invokePreFinalizer);
         unregisterPreFinalizerInternal(&target);
     }
 
+    // Mark an on-heap object as a zombie.  The object won't be swept until
+    // purifyZombies().  It's ok to call markAsZombie() during weak processing.
+    // The specified object must not have references to objects owned by other
+    // threads.
+    // Do not use this function.  This feature is a temporal workaround for

[tkent, 2015/02/17 08:24:39]

Clarified "temporal workaround"

+    // WebAudio, and will be removed soon.
+    void markAsZombie(void*);
+    // Purify all of zombie objects marked before calling purifyZombies().
+    void purifyZombies();
+
     Vector<PageMemoryRegion*>& allocatedRegionsSinceLastGC() { return m_allocatedRegionsSinceLastGC; }
 
     void shouldFlushHeapDoesNotContainCache() { m_shouldFlushHeapDoesNotContainCache = true; }
 
     void registerTraceDOMWrappers(v8::Isolate* isolate, void (*traceDOMWrappers)(v8::Isolate*, Visitor*))
     {
         m_isolate = isolate;
         m_traceDOMWrappers = traceDOMWrappers;
     }
 
@@ skipping 31 matching lines @@
     // Perform registered cleanup tasks and garbage collection
     // to sweep away any objects that are left on this heap.
     // We assert that nothing must remain after this cleanup.
     // If assertion does not hold we crash as we are potentially
     // in the dangling pointer situation.
     void cleanup();
     void cleanupPages();
 
     void unregisterPreFinalizerInternal(void*);
     void invokePreFinalizers(Visitor&);
+    void invokePreMarkingTasks();
+    void invokePostMarkingTasks();
 
 #if ENABLE(GC_PROFILING)
     void snapshotFreeList();
 #endif
 
     static WTF::ThreadSpecific<ThreadState*>* s_threadSpecific;
     static uintptr_t s_mainThreadStackStart;
     static uintptr_t s_mainThreadUnderestimatedStackSize;
     static SafePointBarrier* s_safePointBarrier;
 
@@ skipping 17 matching lines @@
     Vector<Interruptor*> m_interruptors;
     bool m_hasPendingIdleTask;
     bool m_didV8GCAfterLastGC;
     bool m_sweepForbidden;
     size_t m_noAllocationCount;
     size_t m_allocatedObjectSizeBeforeGC;
     BaseHeap* m_heaps[NumberOfHeaps];
 
     Vector<OwnPtr<CleanupTask>> m_cleanupTasks;
     bool m_isTerminating;
+    Vector<MarkingTask*> m_markingTasks;
 
     bool m_shouldFlushHeapDoesNotContainCache;
     double m_collectionRate;
     GCState m_gcState;
 
     CallbackStack* m_weakCallbackStack;
     HashMap<void*, bool (*)(void*, Visitor&)> m_preFinalizers;
-
+    HashSet<void*> m_zombies;

[haraken, 2015/02/17 08:37:03]

Another idea (that will reduce the complexity you need to add to the GC
infrastructure) would be to make the mutator keep the zombie objects alive.

- The responsibility of a GC is just to resurrect zombie objects in each marking
phase.
- The responsibility of a mutator is to hook postMarkingTasks and put the zombie
objects into PersistentVector<Member<AudioNode>>. The mutator drops the
AudioNode from the vector when it becomes really unnecessary.
- Then you need to remove m_zombies and the purifyZombie API from the GC
infrastructure.

That being said, this is a temporary hack and thus I don't much care about it.
If the current code is simpler overall, I'm fine with it.

[tkent, 2015/02/17 23:43:56]

Your idea would be much complex.

- ThreadState needs to have a list of new zombies anyway until ZombieMarking is
done.
- We can't update PersistentVector<Member<AudioNode>> in weak processing because
we can't allocate new collection backing.

     v8::Isolate* m_isolate;
     void (*m_traceDOMWrappers)(v8::Isolate*, Visitor*);
 
 #if defined(ADDRESS_SANITIZER)
     void* m_asanFakeStack;
 #endif
 
     Vector<PageMemoryRegion*> m_allocatedRegionsSinceLastGC;
 
 #if ENABLE(GC_PROFILING)
@@ skipping 69 matching lines @@
         m_locked = false;
     }
 
     MutexBase& m_mutex;
     bool m_locked;
 };
 
 } // namespace blink
 
 #endif // ThreadState_h