angler-fishThe Vulnerability History Project

Web Audio: Oilpan: Trace AudioSummingJunction::m_renderingOutputs

      m_renderingOutpus is a vector of AudioNodeOutput raw pointers.  They are raw
pointers because the vector is allocated in the audio rendering thread, which
has no Oilpan support.  However, They can be last references to the AudioNodeOutput
objects, and Oilpan GC during audio rendering could collect the objects.  We
need to trace the contents of m_renderingOutputs.

This CL fixes crashes.  But unused AudioNodes in the graph are not
destructed automatically unless JavaScript code explicitly disconnect
them from the graph.

BUG=434136

Review URL: https://codereview.chromium.org/782603004

git-svn-id: svn://svn.chromium.org/blink/trunk@186914 bbb929c8-8fbe-4397-9dbb-9b2b20218538
    
commit c9f63369d8e222a54cc5f03d7a03c4cfb56b80fc
-5
expand_less