Bug 1598114 - Never destroy `AudioTimelineEvent` from the render thread when it contains a valid pointer to an `AudioNodeTrack`, and assert it. r=karlt

Differential Revision: https://phabricator.services.mozilla.com/D64759

--HG--
extra : moz-landing-system : lando

dom/media/webaudio/AudioEventTimeline.cpp

@@ -101,6 +101,13 @@ AudioTimelineEvent::AudioTimelineEvent(const AudioTimelineEvent& rhs) {
 }
 
 AudioTimelineEvent::~AudioTimelineEvent() {
+  // AudioTimelineEvent can be destroyed on the render thread. If an event
+  // contains an AudioNodeTrack, it means that this AudioNodeTrack can be
+  // destroyed on the render thread. This in turns can provoke a GC, since it
+  // can be the last reference to GC-able objects. We want to avoid causing GC
+  // on the render thread, so mTrack never points to a valid AudioNodeTrack on
+  // destruction, on the render thread.
+  MOZ_ASSERT(NS_IsMainThread() || !mTrack, "Track reference on the render thread should have been dropped when inserting the event in the timeline.");
   if (mType == AudioTimelineEvent::SetValueCurve) {
     delete[] mCurve;
   }

dom/media/webaudio/AudioEventTimeline.h

@@ -339,6 +339,10 @@ class AudioEventTimeline {
             mEvents[1].Time<TimeType>(), &mEvents[0], nullptr);
       }
 
+      MOZ_ASSERT(!mEvents[0].mTrack,
+                 "AudioParam tracks should never be destroyed on the real-time "
+                 "thread.");
+      JS::AutoSuppressGCAnalysis suppress;
       mEvents.RemoveElementAt(0);
     }
   }

dom/media/webaudio/AudioParamTimeline.h

@@ -42,13 +42,13 @@ class AudioParamTimeline : public AudioEventTimeline {
   }
 
   template <typename TimeType>
-  void InsertEvent(const AudioTimelineEvent& aEvent) {
+  void InsertEvent(AudioTimelineEvent& aEvent) {
     if (aEvent.mType == AudioTimelineEvent::Cancel) {
       CancelScheduledValues(aEvent.Time<TimeType>());
       return;
     }
     if (aEvent.mType == AudioTimelineEvent::Track) {
-      mTrack = aEvent.mTrack;
+      mTrack = aEvent.mTrack.forget();
       return;
     }
     if (aEvent.mType == AudioTimelineEvent::SetValue) {