WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/platform/heap/ThreadState.h

Index: Source/platform/heap/ThreadState.h
diff --git a/Source/platform/heap/ThreadState.h b/Source/platform/heap/ThreadState.h
index a2428428e52eb5fb9229509dee82db3436e9dfc5..91183774f9c10c9ea4f3777273cc76961abaa85a 100644
--- a/Source/platform/heap/ThreadState.h
+++ b/Source/platform/heap/ThreadState.h
@@ -476,6 +476,20 @@ public:
         m_endOfStack = endOfStack;
     }
 
+    // MarkingTask functions are called before and after marking live objects.
+    // They might be called on threads other than the thread associated to this
+    // ThreadState.
+    class MarkingTask {
+    public:
+        virtual ~MarkingTask() { }
+        virtual void willStartMarking(ThreadState&) { }
+        virtual void didFinishMarking(ThreadState&) { }
+    };
+    // A caller is responsible to call removeMarkingTask before deleting the
+    // specified task.
+    void addMarkingTask(MarkingTask*);
+    void removeMarkingTask(MarkingTask*);
+
     // Get one of the heap structures for this thread.
     //
     // The heap is split into multiple heap parts based on object
@@ -488,7 +502,7 @@ public:
     // address ranges for the Blink heap. If the address is in the Blink
     // heap the containing heap page is returned.
     BasePage* findPageFromAddress(Address);
-    BasePage* findPageFromAddress(void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(pointer)); }
+    BasePage* findPageFromAddress(const void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(const_cast<void*>(pointer))); }
 #endif
 
     // List of persistent roots allocated on the given thread.
@@ -582,6 +596,16 @@ public:
         unregisterPreFinalizerInternal(&target);
     }
 
+    // Mark an on-heap object as a zombie.  The object won't be swept until
+    // purifyZombies().  It's ok to call markAsZombie() during weak processing.
+    // The specified object must not have references to objects owned by other
+    // threads.
+    // Do not use this function.  This feature is a temporal workaround for

[tkent, 2015/02/17 08:24:39]

Clarified "temporal workaround"

+    // WebAudio, and will be removed soon.
+    void markAsZombie(void*);
+    // Purify all of zombie objects marked before calling purifyZombies().
+    void purifyZombies();
+
     Vector<PageMemoryRegion*>& allocatedRegionsSinceLastGC() { return m_allocatedRegionsSinceLastGC; }
 
     void shouldFlushHeapDoesNotContainCache() { m_shouldFlushHeapDoesNotContainCache = true; }
@@ -633,6 +657,8 @@ private:
 
     void unregisterPreFinalizerInternal(void*);
     void invokePreFinalizers(Visitor&);
+    void invokePreMarkingTasks();
+    void invokePostMarkingTasks();
 
 #if ENABLE(GC_PROFILING)
     void snapshotFreeList();
@@ -670,6 +696,7 @@ private:
 
     Vector<OwnPtr<CleanupTask>> m_cleanupTasks;
     bool m_isTerminating;
+    Vector<MarkingTask*> m_markingTasks;
 
     bool m_shouldFlushHeapDoesNotContainCache;
     double m_collectionRate;
@@ -677,7 +704,7 @@ private:
 
     CallbackStack* m_weakCallbackStack;
     HashMap<void*, bool (*)(void*, Visitor&)> m_preFinalizers;
-
+    HashSet<void*> m_zombies;

[haraken, 2015/02/17 08:37:03]

Another idea (that will reduce the complexity you need to add to the GC
infrastructure) would be to make the mutator keep the zombie objects alive.

- The responsibility of a GC is just to resurrect zombie objects in each marking
phase.
- The responsibility of a mutator is to hook postMarkingTasks and put the zombie
objects into PersistentVector<Member<AudioNode>>. The mutator drops the
AudioNode from the vector when it becomes really unnecessary.
- Then you need to remove m_zombies and the purifyZombie API from the GC
infrastructure.

That being said, this is a temporary hack and thus I don't much care about it.
If the current code is simpler overall, I'm fine with it.

[tkent, 2015/02/17 23:43:56]

Your idea would be much complex.

- ThreadState needs to have a list of new zombies anyway until ZombieMarking is
done.
- We can't update PersistentVector<Member<AudioNode>> in weak processing because
we can't allocate new collection backing.

     v8::Isolate* m_isolate;
     void (*m_traceDOMWrappers)(v8::Isolate*, Visitor*);