Oilpan: avoid access to to-be-swept ImageLoader object.

Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 62 matching lines @@
 class ImageLoader::Task : public blink::WebThread::Task {
 public:
     static PassOwnPtr<Task> create(ImageLoader* loader, UpdateFromElementBehavior updateBehavior)
     {
         return adoptPtr(new Task(loader, updateBehavior));
     }
 
     Task(ImageLoader* loader, UpdateFromElementBehavior updateBehavior)
         : m_loader(loader)
         , m_shouldBypassMainWorldCSP(shouldBypassMainWorldCSP(loader))
+        , m_updateBehavior(updateBehavior)
         , m_weakFactory(this)
-        , m_updateBehavior(updateBehavior)
     {
     }
 
     virtual void run() override
     {
         if (m_loader) {
+#if ENABLE(OILPAN)
+            // Oilpan: this WebThread::Task microtask may run after the
+            // loader has been GCed, but not yet lazily swept & finalized
+            // (when this task's loader reference will be cleared.)
+            //
+            // Handle this transient condition by explicitly checking here
+            // before going ahead with the update operation. Unsafe to do it
+            // if so, as the objects that the loader refers to may have been
+            // finalized by this time.
+            if (Heap::willObjectBeLazilySwept(m_loader))
+                return;
+#endif
             m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior);
         }
     }
 
     void clearLoader()
     {
         m_loader = 0;
     }
 
     WeakPtr<Task> createWeakPtr()
     {
         return m_weakFactory.createWeakPtr();
     }
 
 private:
     ImageLoader* m_loader;
     BypassMainWorldBehavior m_shouldBypassMainWorldCSP;
+    UpdateFromElementBehavior m_updateBehavior;
     WeakPtrFactory<Task> m_weakFactory;
-    UpdateFromElementBehavior m_updateBehavior;
 };
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
     , m_image(0)
     , m_derefElementTimer(this, &ImageLoader::timerFired)
     , m_hasPendingLoadEvent(false)
     , m_hasPendingErrorEvent(false)
     , m_imageComplete(true)
     , m_loadingImageDocument(false)
@@ skipping 469 matching lines @@
 #endif
 }
 
 #if ENABLE(OILPAN)
 ImageLoader::ImageLoaderClientRemover::~ImageLoaderClientRemover()
 {
     m_loader.willRemoveClient(m_client);
 }
 #endif
 }