WebAudio: Fix AudioNode leak in a case that AudioNode is not disconnected from the graph explicitly.

Source/platform/heap/ThreadState.h

Index: Source/platform/heap/ThreadState.h
diff --git a/Source/platform/heap/ThreadState.h b/Source/platform/heap/ThreadState.h
index 85d4acab08d92585f1fb7e9ff936405f63805a1e..f79209f50e922b927386a0ed4a55cc1617f89315 100644
--- a/Source/platform/heap/ThreadState.h
+++ b/Source/platform/heap/ThreadState.h
@@ -468,6 +468,20 @@ public:
         m_endOfStack = endOfStack;
     }
 
+    // MarkingTask functions are called before and after marking live objects.
+    // They might be called on threads other than the thread associated to this
+    // ThreadState.
+    class MarkingTask {
+    public:
+        virtual ~MarkingTask() { }
+        virtual void willStartMarking(ThreadState&) { }
+        virtual void didFinishMarking(ThreadState&) { }
+    };
+    // A caller is responsible to call removeMarkingTask before deleting the
+    // specified task.
+    void addMarkingTask(MarkingTask*);
+    void removeMarkingTask(MarkingTask*);
+
     // Get one of the heap structures for this thread.
     //
     // The heap is split into multiple heap parts based on object
@@ -480,7 +494,7 @@ public:
     // address ranges for the Blink heap. If the address is in the Blink
     // heap the containing heap page is returned.
     BaseHeapPage* findPageFromAddress(Address);
-    BaseHeapPage* findPageFromAddress(void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(pointer)); }
+    BaseHeapPage* findPageFromAddress(const void* pointer) { return findPageFromAddress(reinterpret_cast<Address>(const_cast<void*>(pointer))); }
 #endif
 
     // List of persistent roots allocated on the given thread.
@@ -570,6 +584,15 @@ public:
         unregisterPreFinalizerInternal(&target);
     }
 
+    // Mark an on-heap object as a zombie.  The object won't be swept until
+    // purifyZombies().  It's ok to call markAsZombie() during weak processing.
+    // The specified object must not have references to objects owned by other
+    // threads.
+    // Do not use this function.  This is only for WebAudio.
+    void markAsZombie(void*);
+    // Purify all of zombie objects marked before calling purifyZombies().
+    void purifyZombies();
+
     Vector<PageMemoryRegion*>& allocatedRegionsSinceLastGC() { return m_allocatedRegionsSinceLastGC; }
 
     void shouldFlushHeapDoesNotContainCache() { m_shouldFlushHeapDoesNotContainCache = true; }
@@ -621,6 +644,8 @@ private:
 
     void unregisterPreFinalizerInternal(void*);
     void invokePreFinalizers(Visitor&);
+    void invokePreMarkingTasks();
+    void invokePostMarkingTasks();
 
 #if ENABLE(GC_PROFILING)
     void snapshotFreeList();
@@ -658,6 +683,7 @@ private:
 
     Vector<OwnPtr<CleanupTask>> m_cleanupTasks;
     bool m_isTerminating;
+    Vector<MarkingTask*> m_markingTasks;
 
     bool m_shouldFlushHeapDoesNotContainCache;
     double m_collectionRate;
@@ -665,7 +691,7 @@ private:
 
     CallbackStack* m_weakCallbackStack;
     HashMap<void*, bool (*)(void*, Visitor&)> m_preFinalizers;
-
+    HashSet<void*> m_zombies;
     v8::Isolate* m_isolate;
     void (*m_traceDOMWrappers)(v8::Isolate*, Visitor*);