Add a check that weak object handle is not in NEAR_DEATH state after weak callback invocation.

src/global-handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 133 matching lines @@
     ASSERT(state_ != DESTROYED);
     return parameter_or_next_free_.parameter;
   }
 
   // Returns the callback for this weak handle.
   WeakReferenceCallback callback() { return callback_; }
 
   bool PostGarbageCollectionProcessing() {
     if (state_ != Node::PENDING) return false;
     LOG(HandleEvent("GlobalHandle::Processing", handle().location()));
+    WeakReferenceCallback func = callback();
+    if (func == NULL) {
+      Destroy();
+      return false;
+    }
     void* par = parameter();
     state_ = NEAR_DEATH;
     set_parameter(NULL);
-    // The callback function is resolved as late as possible to preserve old
-    // behavior.
-    WeakReferenceCallback func = callback();
-    if (func == NULL) return false;
 
     v8::Persistent<v8::Object> object = ToApi<v8::Object>(handle());
     {
       // Forbid reuse of destroyed nodes as they might be already deallocated.
       // It's fine though to reuse nodes that were destroyed in weak callback
       // as those cannot be deallocated until we are back from the callback.
       set_first_free(NULL);
       if (first_deallocated()) {
         first_deallocated()->set_next(head());
       }
       // Check that we are not passing a finalized external string to
       // the callback.
       ASSERT(!object_->IsExternalAsciiString() ||
              ExternalAsciiString::cast(object_)->resource() != NULL);
       ASSERT(!object_->IsExternalTwoByteString() ||
              ExternalTwoByteString::cast(object_)->resource() != NULL);
       // Leaving V8.
       VMState state(EXTERNAL);
       func(object, par);
     }
+    // Absense of explicit cleanup or revival of weak handle
+    // in most of the cases would lead to memory leak.
+    ASSERT(state_ != NEAR_DEATH);
     return true;
   }
 
   // Place the handle address first to avoid offset computation.
   Object* object_;  // Storage for object pointer.
 
   // Transition diagram:
   // NORMAL <-> WEAK -> PENDING -> NEAR_DEATH -> { NORMAL, WEAK, DESTROYED }
   enum State {
     NORMAL,      // Normal global handle.
@@ skipping 316 matching lines @@
 
 void GlobalHandles::RemoveObjectGroups() {
   List<ObjectGroup*>* object_groups = ObjectGroups();
   for (int i = 0; i< object_groups->length(); i++) {
     delete object_groups->at(i);
   }
   object_groups->Clear();
 }
 
 } }  // namespace v8::internal