Undo the reference counting experiment. The crashes are still...

webkit/port/bindings/v8/v8_binding.cpp

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "v8_binding.h"
 
 #include "AtomicString.h"
 #include "CString.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
 #include "StringBuffer.h"
 
 #include <v8.h>
 
 namespace WebCore {
 
 // WebCoreStringResource is a helper class for v8ExternalString. It is used
 // to manage the life-cycle of the underlying buffer of the external string.
 class WebCoreStringResource: public v8::String::ExternalStringResource {
  public:
   explicit WebCoreStringResource(const String& str)
-      : impl_(str.impl()) {
-    // We seem to be occasionally losing the backing string for external
-    // strings: http://crbug.com/9746
-    //
-    // In order to verify that this is caused by a ref counting bug, we
-    // artificially increase the ref count on the backing string until
-    // we are done using it for external strings.
-    //
-    // TODO(ager): This is temporary and should be removed once we have
-    // found the underlying cause of the problem.
-    for (int i = 0; i < kArtificialRefIncrease; i++) {
-      impl_.impl()->ref();
-    }
-  }
+      : impl_(str.impl()) { }
 
-  virtual ~WebCoreStringResource() {
-    // Remove the artificial ref counts added in the constructor.
-    //
-    // TODO(ager): This is temporary and should be removed once we have
-    // found the underlying cause of the problem.
-    for (int i = 0; i < kArtificialRefIncrease; i++) {
-      impl_.impl()->deref();
-    }
-  }
+  virtual ~WebCoreStringResource() {}
 
   const uint16_t* data() const {
     return reinterpret_cast<const uint16_t*>(impl_.characters());
   }
 
   size_t length() const { return impl_.length(); }
 
   String webcore_string() { return impl_; }
 
  private:
-  // The amount by which we artificially increase the reference count
-  // of the backing string.
-  //
-  // TODO(ager): This is temporary and should be removed once we have
-  // found the underlying cause of the problem.
-  static const int kArtificialRefIncrease = 5;
-
   // A shallow copy of the string.
   // Keeps the string buffer alive until the V8 engine garbage collects it.
   String impl_;
 };
 
 String v8StringToWebCoreString(
     v8::Handle<v8::String> v8_str, bool externalize) {
   if (v8_str->IsExternal()) {
     WebCoreStringResource* str_resource = static_cast<WebCoreStringResource*>(
         v8_str->GetExternalStringResource());
@@ skipping 70 matching lines @@
   return v8::String::NewExternal(new WebCoreStringResource(str));
 }
 
 v8::Local<v8::String> v8ExternalString(const String& str) {
   if (!str.length())
     return v8::String::Empty();
   return v8::String::NewExternal(new WebCoreStringResource(str));
 }
 
 }  // namespace WebCore