Do not use untraced members while notifying ActiveDOMObjects.

third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp

Index: third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp
diff --git a/third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp b/third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp
index 38a035cfbf25fb11f831e8ec9c8c943291b1ab74..bb887abfc4ce19dada26d4141a9fa2bfc9b2845c 100644
--- a/third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp
+++ b/third_party/WebKit/Source/core/dom/ContextLifecycleNotifier.cpp
@@ -32,71 +32,53 @@
 
 namespace blink {
 
-void ContextLifecycleNotifier::notifyResumingActiveDOMObjects()
+void ContextLifecycleNotifier::eachActiveDOMObject(void (*f)(ActiveDOMObject*))
 {
+    // This ensures that no ActiveDOMObjects are *added* during iteration.
+    // It does not stop ActiveDOMObjects from being removed.
     TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
+
+    // Take a snapshot of the observers. Observers may be removed
+    // during iteration, hence we need a snapshot for a stable iterator.
+    HeapVector<Member<ContextLifecycleObserver>> snapshotOfObservers;

[sof, 2016/06/24 05:57:59]

Could you explain why this is needed? We don't want to do unnecessary heap
allocation.

+    snapshotOfObservers.reserveInitialCapacity(m_observers.size());
     copyToVector(m_observers, snapshotOfObservers);
+
     for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // FIXME: Oilpan: At the moment, it's possible that a ActiveDOMObject
-        // observer is destructed while iterating. Once we enable Oilpan by default
-        // for all LifecycleObserver<T>s, we can remove the hack by making m_observers
-        // a HeapHashSet<WeakMember<LifecycleObserver<T>>>.
-        // (i.e., we can just iterate m_observers without taking a snapshot).
-        // For more details, see https://codereview.chromium.org/247253002/.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
+        if (!m_observers.contains(observer))
+            continue;
+
+        if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
+            continue;
+
+        ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
 #if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
+        DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
+        DCHECK(activeDOMObject->suspendIfNeededCalled());
 #endif
-            activeDOMObject->resume();
-        }
+        f(activeDOMObject);
     }
 }
 
+void ContextLifecycleNotifier::notifyResumingActiveDOMObjects()
+{
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->resume();
+    });
+}
+
 void ContextLifecycleNotifier::notifySuspendingActiveDOMObjects()
 {
-    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
-    copyToVector(m_observers, snapshotOfObservers);
-    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // It's possible that the ActiveDOMObject is already destructed.
-        // See a FIXME above.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
-#if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
-#endif
-            activeDOMObject->suspend();
-        }
-    }
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->suspend();
+    });
 }
 
 void ContextLifecycleNotifier::notifyStoppingActiveDOMObjects()
 {
-    TemporaryChange<IterationType> scope(m_iterating, IteratingOverAll);
-    Vector<UntracedMember<ContextLifecycleObserver>> snapshotOfObservers;
-    copyToVector(m_observers, snapshotOfObservers);
-    for (ContextLifecycleObserver* observer : snapshotOfObservers) {
-        // It's possible that the ActiveDOMObject is already destructed.
-        // See a FIXME above.
-        if (m_observers.contains(observer)) {
-            if (observer->observerType() != ContextLifecycleObserver::ActiveDOMObjectType)
-                continue;
-            ActiveDOMObject* activeDOMObject = static_cast<ActiveDOMObject*>(observer);
-#if DCHECK_IS_ON()
-            DCHECK_EQ(activeDOMObject->getExecutionContext(), context());
-            DCHECK(activeDOMObject->suspendIfNeededCalled());
-#endif
-            activeDOMObject->stop();
-        }
-    }
+    eachActiveDOMObject([](ActiveDOMObject* object) {
+        object->stop();
+    });
 }
 
 unsigned ContextLifecycleNotifier::activeDOMObjectCount() const