Do not use untraced members while notifying ActiveDOMObjects.

third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * Copyright (C) 2013 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 14 matching lines @@
  *
  */
 
 #include "core/dom/ContextLifecycleNotifier.h"
 
 #include "core/dom/ActiveDOMObject.h"
 #include "wtf/TemporaryChange.h"
 
 namespace blink {
 
+void ContextLifecycleNotifier::eachActiveDOMObject(void (*f)(ActiveDOMObject*))
+{
+    // This ensures that no ActiveDOMObjects are *added* during iteration.
+    // It does not stop ActiveDOMObjects from being removed.
+    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
+
+    // Take a snapshot of the observers. Observers may be removed
+    // during iteration, hence we need a snapshot for a stable iterator.
+    HeapVector<Member<ContextLifecycleObserver>> snapshotOfObservers;

[sof, 2016/06/24 05:57:59]

Could you explain why this is needed? We don't want to do unnecessary heap
allocation.

+    snapshotOfObservers.reserveInitialCapacity(m_observers.size());
+    copyToVector(m_observers, snapshotOfObservers);
+
+    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
+        if (!m_observers.contains(observer))
+            continue;
+
+        if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
+            continue;
+
+        ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
+#if DCHECK_IS_ON()
+        DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
+        DCHECK(activeDOMObject->suspendIfNeededCalled());
+#endif
+        f(activeDOMObject);
+    }
+}
+
 void ContextLifecycleNotifier::notifyResumingActiveDOMObjects()
 {
-    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
-    copyToVector(m_observers, snapshotOfObservers);
-    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // FIXME: Oilpan: At the moment, it's possible that a ActiveDOMObject
-        // observer is destructed while iterating. Once we enable Oilpan by default
-        // for all LifecycleObserver<T>s, we can remove the hack by making m_observers
-        // a HeapHashSet<WeakMember<LifecycleObserver<T>>>.
-        // (i.e., we can just iterate m_observers without taking a snapshot).
-        // For more details, see https://codereview.chromium.org/247253002/.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
-#if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
-#endif
-            activeDOMObject->resume();
-        }
-    }
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->resume();
+    });
 }
 
 void ContextLifecycleNotifier::notifySuspendingActiveDOMObjects()
 {
-    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
-    copyToVector(m_observers, snapshotOfObservers);
-    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // It's possible that the ActiveDOMObject is already destructed.
-        // See a FIXME above.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
-#if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
-#endif
-            activeDOMObject->suspend();
-        }
-    }
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->suspend();
+    });
 }
 
 void ContextLifecycleNotifier::notifyStoppingActiveDOMObjects()
 {
-    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
-    copyToVector(m_observers, snapshotOfObservers);
-    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // It's possible that the ActiveDOMObject is already destructed.
-        // See a FIXME above.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
-#if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
-#endif
-            activeDOMObject->stop();
-        }
-    }
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->stop();
+    });
 }
 
 unsigned ContextLifecycleNotifier::activeDOMObjectCount() const
 {
     unsigned activeDOMObjects = 0;
     for (ContextLifecycleObserver* observer : m_observers) {
         if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
             continue;
         activeDOMObjects++;
     }
     return activeDOMObjects;
 }
 
 #if DCHECK_IS_ON()
 bool ContextLifecycleNotifier::contains(ActiveDOMObject* object) const
 {
     for (ContextLifecycleObserver* observer : m_observers) {
         if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
             continue;
         ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
         if (activeDOMObject == object)
             return true;
     }
     return false;
 }
 #endif
 
 } // namespace blink