WebAudio: Fix PannerNode liveness

Canonical fix:
- Model liveness through PannerNode (AudioNode), i.e., keep alive
  listener from there.
- Change off-thread handler to use a weak root

This works as AudioNode disposes the handler in the pre-finalizer.

Bug: 928781, 843903
Change-Id: I3b7454adcfbd2ab2c993974c3cda0415c1a20427
Reviewed-on: https://chromium-review.googlesource.com/c/1486092Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Hongchan Choi <hongchan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#635139}

third_party/blink/renderer/modules/webaudio/panner_node.cc

@@ -705,12 +705,13 @@ PannerNode::PannerNode(BaseAudioContext& context)
                              0.0,
                              AudioParamHandler::AutomationRate::kAudio,
                              AudioParamHandler::AutomationRateMode::kVariable)),
-      orientation_z_(AudioParam::Create(
-          context,
-          kParamTypePannerOrientationZ,
-          0.0,
-          AudioParamHandler::AutomationRate::kAudio,
-          AudioParamHandler::AutomationRateMode::kVariable)) {
+      orientation_z_(
+          AudioParam::Create(context,
+                             kParamTypePannerOrientationZ,
+                             0.0,
+                             AudioParamHandler::AutomationRate::kAudio,
+                             AudioParamHandler::AutomationRateMode::kVariable)),
+      listener_(context.listener()) {
   SetHandler(PannerHandler::Create(
       *this, context.sampleRate(), position_x_->Handler(),
       position_y_->Handler(), position_z_->Handler(), orientation_x_->Handler(),
@@ -875,11 +876,10 @@ void PannerNode::Trace(blink::Visitor* visitor) {
   visitor->Trace(position_x_);
   visitor->Trace(position_y_);
   visitor->Trace(position_z_);
-
   visitor->Trace(orientation_x_);
   visitor->Trace(orientation_y_);
   visitor->Trace(orientation_z_);
-
+  visitor->Trace(listener_);
   AudioNode::Trace(visitor);
 }
 

third_party/blink/renderer/modules/webaudio/panner_node.h

@@ -156,9 +156,8 @@ class PannerHandler final : public AudioHandler {
   bool IsDistanceConeGainDirty() const { return is_distance_cone_gain_dirty_; }
   void UpdateDirtyState();
 
-  // This Persistent doesn't make a reference cycle including the owner
-  // PannerNode. It is accessed by both audio and main thread.
-  CrossThreadPersistent<AudioListener> listener_;
+  // AudioListener is held alive by PannerNode.
+  CrossThreadWeakPersistent<AudioListener> listener_;
   std::unique_ptr<Panner> panner_;
   unsigned panning_model_;
   unsigned distance_model_;
@@ -254,6 +253,10 @@ class PannerNode final : public AudioNode {
   Member<AudioParam> orientation_x_;
   Member<AudioParam> orientation_y_;
   Member<AudioParam> orientation_z_;
+
+  // This listener is held alive here to allow referencing it from PannerHandler
+  // via weak reference.
+  Member<AudioListener> listener_;
 };
 
 }  // namespace blink