Have ScriptPromiseResolver on the Oilpan heap always.

Source/bindings/core/v8/ScriptPromiseResolver.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 
 #include "bindings/core/v8/V8RecursionScope.h"
 #include "platform/LifecycleObserver.h"
 
 namespace blink {
 
 ScriptPromiseResolver::ScriptPromiseResolver(ScriptState* scriptState)
     : ActiveDOMObject(scriptState->executionContext())
     , m_state(Pending)
     , m_scriptState(scriptState)
-    , m_mode(Default)
     , m_timer(this, &ScriptPromiseResolver::onTimerFired)
     , m_resolver(scriptState)
 #if ENABLE(ASSERT)
     , m_isPromiseCalled(false)
 #endif
 {
     if (executionContext()->activeDOMObjectsAreStopped()) {
         m_state = ResolvedOrRejected;
         m_resolver.clear();
     }
@@ skipping 11 matching lines @@
 }
 
 void ScriptPromiseResolver::stop()
 {
     m_timer.stop();
     clear();
 }
 
 void ScriptPromiseResolver::keepAliveWhilePending()
 {
-    if (m_state == ResolvedOrRejected || m_mode == KeepAliveWhilePending)
+    if (m_state == ResolvedOrRejected || m_keepAlive)

[haraken, 2015/07/18 08:01:23]

Instead of adding '|| m_keepAlive', can we add ASSERT(!m_keepAlive)?

[sof, 2015/07/18 20:46:08]

I don't think that's accurate - how do you reason to suggest that here?

i.e., consider MIDIAccessInitializer::start() being called with an execution
context in a suspended state. It'll set m_keepAlive. start() may then progress
and try to call reject() (say), where ScriptPromiseResolver will call
keepAliveWhilePending() again (via resolveOrReject()). m_keepAlive will then be
set.

[haraken, 2015/07/19 07:25:50]

Makes sense! Would be worth having a comment -- keepAliveWhilePending can be
called multiple times but those are expected to be cleared with one clear()
call.

[sof, 2015/07/20 11:01:43]

Added clarifying comment.

         return;
 
-    // Keep |this| while the promise is Pending.
-    // deref() will be called in clear().
-    m_mode = KeepAliveWhilePending;
-    ref();
+    // Keep |this| around while the promise is Pending;
+    // see clear() for the dual operation.
+    m_keepAlive = this;
 }
 
 void ScriptPromiseResolver::onTimerFired(Timer<ScriptPromiseResolver>*)
 {
     ASSERT(m_state == Resolving || m_state == Rejecting);
     ScriptState::Scope scope(m_scriptState.get());
     resolveOrRejectImmediately();
 }
 
 void ScriptPromiseResolver::resolveOrRejectImmediately()
 {
     ASSERT(!executionContext()->activeDOMObjectsAreStopped());
     ASSERT(!executionContext()->activeDOMObjectsAreSuspended());
     {
         if (m_state == Resolving) {
             m_resolver.resolve(m_value.newLocal(m_scriptState->isolate()));
         } else {
             ASSERT(m_state == Rejecting);
             m_resolver.reject(m_value.newLocal(m_scriptState->isolate()));
         }
     }
     clear();
 }
 
 void ScriptPromiseResolver::clear()
 {
     if (m_state == ResolvedOrRejected)
         return;
-    ResolutionState state = m_state;
     m_state = ResolvedOrRejected;
     m_resolver.clear();
     m_value.clear();
-    if (m_mode == KeepAliveWhilePending) {
-        // |ref| was called in |keepAliveWhilePending|.
-        deref();
-    }
-    // |this| may be deleted here, but it is safe to check |state| because
-    // it doesn't depend on |this|. When |this| is deleted, |state| can't be
-    // |Resolving| nor |Rejecting| and hence |this->deref()| can't be executed.
-    if (state == Resolving || state == Rejecting) {
-        // |ref| was called in |resolveOrReject|.
-        deref();
-    }
+    m_keepAlive.clear();
 }
 
 DEFINE_TRACE(ScriptPromiseResolver)
 {
     ActiveDOMObject::trace(visitor);
 }
 
 } // namespace blink