WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/platform/heap/ThreadState.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 967 matching lines @@
 
 void ThreadState::preGC()
 {
     ASSERT(!isInGC());
     setGCState(GCRunning);
     makeConsistentForSweeping();
     prepareRegionTree();
     flushHeapDoesNotContainCacheIfNeeded();
     if (isMainThread())
         m_allocatedObjectSizeBeforeGC = Heap::allocatedObjectSize() + Heap::markedObjectSize();
+    invokePreMarkingTasks();
 }
 
 void ThreadState::postGC(GCType gcType)
 {
     ASSERT(isInGC());
+    invokePostMarkingTasks();
     setGCState(gcType == GCWithSweep ? EagerSweepScheduled : LazySweepScheduled);
     for (int i = 0; i < NumberOfHeaps; i++)
         m_heaps[i]->prepareForSweep();
 }
 
+void ThreadState::invokePreMarkingTasks()
+{
+    ASSERT(isInGC());
+    for (MarkingTask* task : m_markingTasks)
+        task->willStartMarking(*this);
+}
+
+void ThreadState::invokePostMarkingTasks()
+{
+    ASSERT(isInGC());
+    for (size_t i = m_markingTasks.size(); i > 0; --i)
+        m_markingTasks[i - 1]->didFinishMarking(*this);
+}
+
+void ThreadState::addMarkingTask(MarkingTask* task)
+{
+    ASSERT(!isInGC());
+    checkThread();
+    m_markingTasks.append(task);
+}
+
+void ThreadState::removeMarkingTask(MarkingTask* task)
+{
+    ASSERT(!isInGC());
+    checkThread();
+    size_t position = m_markingTasks.find(task);
+    ASSERT(position != kNotFound);
+    m_markingTasks.remove(position);
+}
+
 void ThreadState::prepareHeapForTermination()
 {
     checkThread();
     for (int i = 0; i < NumberOfHeaps; ++i)
         m_heaps[i]->prepareHeapForTermination();
 }
 
 #if ENABLE(ASSERT) || ENABLE(GC_PROFILING)
 BaseHeapPage* ThreadState::findPageFromAddress(Address address)
 {
@@ skipping 144 matching lines @@
                 TRACE_EVENT0("blink_gc", "ThreadState::threadLocalWeakProcessing");
                 // Perform thread-specific weak processing.
                 while (popAndInvokeWeakPointerCallback(Heap::s_markingVisitor)) { }
             }
             {
                 TRACE_EVENT0("blink_gc", "ThreadState::invokePreFinalizers");
                 invokePreFinalizers(*Heap::s_markingVisitor);
             }
         }
 
+        if (!m_zombies.isEmpty()) {
+            TRACE_EVENT0("blink_gc", "Heap::visitObjects");
+            // The following marking should not run in multiple threads because
+            // it uses global resources such as s_markingStack.
+            SafePointAwareMutexLocker locker(threadAttachMutex(), NoHeapPointersOnStack);
+            GCState originalState = gcState();
+            setGCState(GCRunning);
+            invokePreMarkingTasks();
+            Heap::visitObjects(this, m_zombies);
+            invokePostMarkingTasks();
+            setGCState(originalState);
+        }
+
         if (isMainThread())
             ScriptForbiddenScope::exit();
     }
 
 #if ENABLE(OILPAN)
     if (gcState() == EagerSweepScheduled) {
         // Eager sweeping should happen only in testing.
         setGCState(Sweeping);
         completeSweep();
     } else {
@@ skipping 63 matching lines @@
     checkThread();
     Vector<void*> deadObjects;
     for (auto& entry : m_preFinalizers) {
         if (entry.value(entry.key, visitor))
             deadObjects.append(entry.key);
     }
     // FIXME: removeAll is inefficient.  It can shrink repeatedly.
     m_preFinalizers.removeAll(deadObjects);
 }
 
+void ThreadState::markAsZombie(void* object)
+{
+    ASSERT(!isInGC());
+    checkThread();
+    ASSERT(!m_zombies.contains(object));
+    m_zombies.add(object);
+}
+
+void ThreadState::purifyZombies()
+{
+    m_zombies.clear();
+}
+
 #if ENABLE(GC_PROFILING)
 const GCInfo* ThreadState::findGCInfoFromAllThreads(Address address)
 {
     bool needLockForIteration = !ThreadState::current()->isInGC();
     if (needLockForIteration)
         threadAttachMutex().lock();
 
     for (ThreadState* state : attachedThreads()) {
         if (const GCInfo* gcInfo = state->findGCInfo(address)) {
             if (needLockForIteration)
@@ skipping 41 matching lines @@
     FOR_EACH_TYPED_HEAP(SNAPSHOT_FREE_LIST);
     json->endArray();
 
 #undef SNAPSHOT_FREE_LIST
 
     TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID(TRACE_DISABLED_BY_DEFAULT("blink_gc"), "FreeList", this, json.release());
 }
 #endif
 
 } // namespace blink