WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/modules/webaudio/AudioContext.cpp

 /*
  * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1.  Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 91 matching lines @@
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
     , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
+    , m_lastZombie(nullptr)
+    , m_lastRemovableZombie(nullptr)
     , m_isOfflineContext(false)
     , m_contextState(Suspended)
     , m_cachedSampleFrame(0)
 {
     m_didInitializeContextGraphMutex = true;
     m_destinationNode = DefaultAudioDestinationNode::create(this);
 
     initialize();
 #if DEBUG_AUDIONODE_REFERENCES
     fprintf(stderr, "%p: AudioContext::AudioContext() #%u\n", this, AudioContext::s_hardwareContextCount);
 #endif
 }
 
 // Constructor for offline (non-realtime) rendering.
 AudioContext::AudioContext(Document* document, unsigned numberOfChannels, size_t numberOfFrames, float sampleRate)
     : ActiveDOMObject(document)
     , m_isStopScheduled(false)
     , m_isCleared(false)
     , m_isInitialized(false)
     , m_destinationNode(nullptr)
     , m_isResolvingResumePromises(false)
     , m_automaticPullNodesNeedUpdating(false)
     , m_connectionCount(0)
     , m_didInitializeContextGraphMutex(false)
     , m_audioThread(0)
+    , m_lastZombie(nullptr)
+    , m_lastRemovableZombie(nullptr)
     , m_isOfflineContext(true)
     , m_contextState(Suspended)
     , m_cachedSampleFrame(0)
 {
     m_didInitializeContextGraphMutex = true;
     // Create a new destination for offline rendering.
     m_renderTarget = AudioBuffer::create(numberOfChannels, numberOfFrames, sampleRate);
     if (m_renderTarget.get())
         m_destinationNode = OfflineAudioDestinationNode::create(this, m_renderTarget.get());
 
     initialize();
 }
 
 AudioContext::~AudioContext()
 {
 #if DEBUG_AUDIONODE_REFERENCES
     fprintf(stderr, "%p: AudioContext::~AudioContext()\n", this);
 #endif
     // AudioNodes keep a reference to their context, so there should be no way to be in the destructor if there are still AudioNodes around.
     ASSERT(!m_isInitialized);
     ASSERT(!m_referencedNodes.size());
     ASSERT(!m_finishedNodes.size());
     ASSERT(!m_automaticPullNodes.size());
     if (m_automaticPullNodesNeedUpdating)
         m_renderingAutomaticPullNodes.resize(m_automaticPullNodes.size());
     ASSERT(!m_renderingAutomaticPullNodes.size());
     ASSERT(!m_suspendResolvers.size());
     ASSERT(!m_resumeResolvers.size());
+    ThreadState::current()->removeMarkingTask(this);

[haraken, 2015/02/06 07:57:23]

Can we move this to AudioContext::uninitialize()?

[tkent, 2015/02/09 07:00:50]

Yes.  It's consistent because we call addMarkingTask in initialize().  Done.

We need to call purifyZombies() before a marking after the last
AudioContext::handlePostRenderTasks().  uninitialize().  So, we also need to add
purifyZombies() to uninitialize().

 }
 
 void AudioContext::initialize()
 {
     if (isInitialized())
         return;
 
+    ThreadState::current()->addMarkingTask(this);
     FFTFrame::initialize();
     m_listener = AudioListener::create();
 
     if (m_destinationNode.get()) {
         m_destinationNode->initialize();
 
         if (!isOfflineContext()) {
             // This starts the audio thread. The destination node's provideInput() method will now be called repeatedly to render audio.
             // Each time provideInput() is called, a portion of the audio stream is rendered. Let's call this time period a "render quantum".
             // NOTE: for now default AudioContext does not need an explicit startRendering() call from JavaScript.
@@ skipping 628 matching lines @@
     if (tryLock()) {
         // Update the channel count mode.
         updateChangedChannelCountMode();
 
         // Take care of AudioNode tasks where the tryLock() failed previously.
         handleDeferredAudioNodeTasks();
 
         // Dynamically clean up nodes which are no longer needed.
         derefFinishedSourceNodes();
 
+        m_lastRemovableZombie = m_lastZombie;
+
         // Fixup the state of any dirty AudioSummingJunctions and AudioNodeOutputs.
         handleDirtyAudioSummingJunctions();
         handleDirtyAudioNodeOutputs();
 
         updateAutomaticPullNodes();
         resolvePromisesForSuspend();
 
         unlock();
     }
 }
@@ skipping 273 matching lines @@
         m_offlineResolver->resolve(renderedBuffer);
     }
 }
 
 void AudioContext::trace(Visitor* visitor)
 {
     visitor->trace(m_offlineResolver);
     visitor->trace(m_renderTarget);
     visitor->trace(m_destinationNode);
     visitor->trace(m_listener);
-    // trace() can be called in AudioContext constructor, and
-    // m_contextGraphMutex might be unavailable.
-    if (m_didInitializeContextGraphMutex) {
-        AutoLocker lock(this);
-        visitor->trace(m_referencedNodes);
-    } else {
-        visitor->trace(m_referencedNodes);
-    }
+    visitor->trace(m_referencedNodes);
     visitor->trace(m_resumeResolvers);
     visitor->trace(m_suspendResolvers);
     visitor->trace(m_liveNodes);
     visitor->trace(m_liveAudioSummingJunctions);
     RefCountedGarbageCollectedEventTargetWithInlineData<AudioContext>::trace(visitor);
     ActiveDOMObject::trace(visitor);
 }
 
 void AudioContext::addChangedChannelCountMode(AudioNode* node)
 {
@@ skipping 17 matching lines @@
         (*k)->updateChannelCountMode();
 
     m_deferredCountModeChange.clear();
 }
 
 SecurityOrigin* AudioContext::securityOrigin() const
 {
     return executionContext()->securityOrigin();
 }
 
+void AudioContext::setLastZombie(void* object)
+{
+    ASSERT(isGraphOwner());
+    m_lastZombie = object;
+}
+
+void AudioContext::willStartMarking(ThreadState& threadState)

[haraken, 2015/02/06 07:57:23]

willStartMarking is called not only in the ZombieMarking but also in a normal
global marking. Is it OK (if so, why)?

[tkent, 2015/02/09 07:00:50]

It's ok.
There are two purposes of this hook:

* Simplify AudioContext::trace by calling lock()/unlock() in the task
  We need this for both of global marking and zombie marking.

* Calls purifyZombies() before zombie marking
  purifyZombies() on one of the markings is enough, and purifyZombies() on both
of markings is harmless.   The current code applies the latter for code
simplicity.

+{
+    lock();

[haraken, 2015/02/06 07:57:23]

What happens if a GC is triggered during AudioContext's constructor before the
lock gets initialized?

[tkent, 2015/02/09 07:00:50]

It won't happen.  This task is registered after the mutex initialization.

+    if (!m_lastRemovableZombie)
+        return;
+    if (m_lastZombie != m_lastRemovableZombie)

[haraken, 2015/02/06 07:57:23]

I don't quite get what m_lastZombie and m_lastRemovableZombie point to. Would
you elaborate?

[tkent, 2015/02/09 07:00:50]

We need to avoid the following scenario:

1. GC happens
2. Some AudioNodes are unreachable, and their weak processing makes them
zombies.
3. Another GC happens.  We can't call purifyZombies() yet because
AudioContext::handlePostRenderTasks() is not called yet.
4. AudioContext::handlePostRenderTasks() is called on audio thread.  We may
purify all existing zombies, but we can't purify immediately because we're on
audio thread.
5. Another GC happens.  More AudioNodes are unreachable and their weak
processing adds new zombies.
6. Now, we can purify zombies made at step 2, but shouldn't purify zombies made
at step 5.

There are some ways to resolve this issue.  The current code would be the
simplest one.

+        return;
+    threadState.purifyZombies();
+    m_lastZombie = nullptr;
+    m_lastRemovableZombie = nullptr;
+}
+
+void AudioContext::didFinishMarking(ThreadState&)
+{
+    unlock();
+}
+
 } // namespace blink
 
 #endif // ENABLE(WEB_AUDIO)