Oilpan: avoid access to to-be-swept ImageLoader object.

Source/core/loader/ImageLoader.cpp

Index: Source/core/loader/ImageLoader.cpp
diff --git a/Source/core/loader/ImageLoader.cpp b/Source/core/loader/ImageLoader.cpp
index a49ab8df6509ab49e7abba6dcdcdef979cb9a8fb..6eeb61f9c3371368491730b2c9ed363ff10859fc 100644
--- a/Source/core/loader/ImageLoader.cpp
+++ b/Source/core/loader/ImageLoader.cpp
@@ -80,14 +80,18 @@ public:
     Task(ImageLoader* loader, UpdateFromElementBehavior updateBehavior)
         : m_loader(loader)
         , m_shouldBypassMainWorldCSP(shouldBypassMainWorldCSP(loader))
-        , m_weakFactory(this)
         , m_updateBehavior(updateBehavior)

[kouhei (in TOK), 2015/02/13 00:25:58]

unintended change?

[sof, 2015/02/13 06:40:48]

It helps to be have the weak factory last, and keep that as a pattern through
the codebase. Which is what I tidied here.

[kouhei (in TOK), 2015/02/13 09:00:34]

sgtm. It might be helpful to mention about this change in CL description.

+        , m_weakFactory(this)
     {
     }
 
     virtual void run() override
     {
         if (m_loader) {
+#if ENABLE(OILPAN)
+            if (Heap::willObjectBeLazilySwept(m_loader))
+                return;

[kouhei (in TOK), 2015/02/13 00:25:58]

Is this needed for all places where non-Oilpan object access Oilpan object via
raw ptr?
In particular, would this be needed for the below too?:
https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...

[haraken, 2015/02/13 01:41:59]

In most cases, no.

This hack is needed only when you cannot clear the raw pointer (for some reason)
before you start sweeping. Unless you have a strong reason, you should try hard
to clear the raw pointer before starting a sweep phase that collects the on-heap
object.

[sof, 2015/02/13 06:40:48]

I will go through the Microtasks and check if they're similarly vulnerable to
this lazy-sweep condition.

+#endif
             m_loader->doUpdateFromElement(m_shouldBypassMainWorldCSP, m_updateBehavior);
         }
     }
@@ -105,8 +109,8 @@ public:
 private:
     ImageLoader* m_loader;
     BypassMainWorldBehavior m_shouldBypassMainWorldCSP;
-    WeakPtrFactory<Task> m_weakFactory;
     UpdateFromElementBehavior m_updateBehavior;

[kouhei (in TOK), 2015/02/13 00:25:58]

Ditto.

+    WeakPtrFactory<Task> m_weakFactory;
 };
 
 ImageLoader::ImageLoader(Element* element)