blink: Fix regressions caused by delayed destruction of heap containers

This is to fix number of regressions in browsing/rendering_desktop
benchmarks which occurred after heap collections became trivially
finalizable.

Bug: 1002372
Change-Id: I61267729c616e9cb83d5c3ccb61699fdae6d1cb2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1807120Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#697585}

third_party/blink/renderer/bindings/bindings.gni

@@ -113,6 +113,7 @@ bindings_core_v8_files =
                     "core/v8/serialization/serialized_script_value.h",
                     "core/v8/serialization/serialized_script_value_factory.cc",
                     "core/v8/serialization/serialized_script_value_factory.h",
+                    "core/v8/serialization/transferables.cc",
                     "core/v8/serialization/transferables.h",
                     "core/v8/serialization/unpacked_serialized_script_value.cc",
                     "core/v8/serialization/unpacked_serialized_script_value.h",

third_party/blink/renderer/bindings/core/v8/serialization/serialized_script_value.cc

@@ -704,6 +704,16 @@ SerializedScriptValue::TransferArrayBufferContents(
 
   contents.Grow(array_buffers.size());
   HeapHashSet<Member<DOMArrayBufferBase>> visited;
+  // The scope object to promptly free the backing store to avoid memory
+  // regressions.
+  // TODO(bikineev): Revisit after young generation is there.
+  struct PromptlyFreeSet {
+    // The void* is to avoid blink-gc-plugin error.
+    void* buffer;
+    ~PromptlyFreeSet() {
+      static_cast<HeapHashSet<Member<DOMArrayBufferBase>>*>(buffer)->clear();
+    }
+  } promptly_free_array_buffers{&visited};
   for (auto* it = array_buffers.begin(); it != array_buffers.end(); ++it) {
     DOMArrayBufferBase* array_buffer_base = *it;
     if (visited.Contains(array_buffer_base))

third_party/blink/renderer/bindings/core/v8/serialization/transferables.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "third_party/blink/renderer/bindings/core/v8/serialization/transferables.h"
+
+#include "third_party/blink/renderer/core/imagebitmap/image_bitmap.h"
+#include "third_party/blink/renderer/core/messaging/message_port.h"
+#include "third_party/blink/renderer/core/mojo/mojo_handle.h"
+#include "third_party/blink/renderer/core/offscreencanvas/offscreen_canvas.h"
+#include "third_party/blink/renderer/core/streams/readable_stream.h"
+#include "third_party/blink/renderer/core/streams/transform_stream.h"
+#include "third_party/blink/renderer/core/streams/writable_stream.h"
+#include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h"
+
+namespace blink {
+
+Transferables::~Transferables() {
+  // Explicitly free all backing stores for containers to avoid memory
+  // regressions.
+  // TODO(bikineev): Revisit after young generation is there.
+  array_buffers.clear();
+  image_bitmaps.clear();
+  offscreen_canvases.clear();
+  message_ports.clear();
+  mojo_handles.clear();
+  readable_streams.clear();
+  writable_streams.clear();
+  transform_streams.clear();
+}
+
+}  // namespace blink

third_party/blink/renderer/bindings/core/v8/serialization/transferables.h

@@ -35,6 +35,7 @@ class CORE_EXPORT Transferables final {
 
  public:
   Transferables() = default;
+  ~Transferables();
 
   ArrayBufferArray array_buffers;
   ImageBitmapArray image_bitmaps;

third_party/blink/renderer/bindings/core/v8/serialization/v8_script_value_serializer.cc

@@ -151,6 +151,16 @@ void V8ScriptValueSerializer::FinalizeTransfer(
   v8::Isolate* isolate = script_state_->GetIsolate();
 
   ArrayBufferArray array_buffers;
+  // The scope object to promptly free the backing store to avoid memory
+  // regressions.
+  // TODO(bikineev): Revisit after young generation is there.
+  struct PromptlyFreeArrayBuffers {
+    // The void* is to avoid blink-gc-plugin error.
+    void* buffer;
+    ~PromptlyFreeArrayBuffers() {
+      static_cast<ArrayBufferArray*>(buffer)->clear();
+    }
+  } promptly_free_array_buffers{&array_buffers};
   if (transferables_)
     array_buffers.AppendVector(transferables_->array_buffers);
 

third_party/blink/renderer/core/animation/document_timeline.cc

@@ -182,6 +182,9 @@ void DocumentTimeline::ServiceAnimations(TimingUpdateReason reason) {
   for (const auto& animation : animations_needing_update_)
     DCHECK(!animation->Outdated());
 #endif
+  // Explicitly free the backing store to avoid memory regressions.
+  // TODO(bikineev): Revisit when young generation is done.
+  animations.clear();
 }
 
 void DocumentTimeline::ScheduleNextService() {

third_party/blink/renderer/core/frame/local_frame_view.cc

@@ -2002,6 +2002,9 @@ void LocalFrameView::UpdateGeometriesIfNeeded() {
 
     view->UpdateGeometry();
   }
+  // Explicitly free the backing store to avoid memory regressions.
+  // TODO(bikineev): Revisit after young generation is there.
+  views.clear();
 }
 
 void LocalFrameView::UpdateAllLifecyclePhases(

third_party/blink/renderer/platform/lifecycle_notifier.h

@@ -161,6 +161,9 @@ inline void LifecycleNotifier<T, Observer>::NotifyContextDestroyed() {
     ContextDestroyedNotifier<Observer, T>::Call(observer, Context());
     observer->ClearContext();
   }
+  // Explicitly free the backing store to avoid memory regressions.
+  // TODO(bikineev): Revisit after young generation is done.
+  observers.clear();
 }
 
 template <typename T, typename Observer>

third_party/blink/renderer/platform/loader/fetch/resource_fetcher.cc

@@ -2026,6 +2026,9 @@ void ResourceFetcher::UpdateAllImageResourcePriorities() {
   }
 
   not_loaded_image_resources_.RemoveAll(to_be_removed);
+  // Explicitly free the backing store to not regress memory.
+  // TODO(bikineev): Revisit when young generation is done.
+  to_be_removed.clear();
 }
 
 void ResourceFetcher::ReloadLoFiImages() {