Have ScriptPromiseResolver on the Oilpan heap always.

Source/bindings/core/v8/ScriptPromiseResolver.cpp

Index: Source/bindings/core/v8/ScriptPromiseResolver.cpp
diff --git a/Source/bindings/core/v8/ScriptPromiseResolver.cpp b/Source/bindings/core/v8/ScriptPromiseResolver.cpp
index 993484f0865a734fe644aefbbdcef170f107017f..42f0b7da600d539b356d7f5ad4681d76566d8fd5 100644
--- a/Source/bindings/core/v8/ScriptPromiseResolver.cpp
+++ b/Source/bindings/core/v8/ScriptPromiseResolver.cpp
@@ -14,7 +14,6 @@ ScriptPromiseResolver::ScriptPromiseResolver(ScriptState* scriptState)
     : ActiveDOMObject(scriptState->executionContext())
     , m_state(Pending)
     , m_scriptState(scriptState)
-    , m_mode(Default)
     , m_timer(this, &ScriptPromiseResolver::onTimerFired)
     , m_resolver(scriptState)
 #if ENABLE(ASSERT)
@@ -46,13 +45,12 @@ void ScriptPromiseResolver::stop()
 
 void ScriptPromiseResolver::keepAliveWhilePending()
 {
-    if (m_state == ResolvedOrRejected || m_mode == KeepAliveWhilePending)
+    if (m_state == ResolvedOrRejected || m_keepAlive)
         return;
 
-    // Keep |this| while the promise is Pending.
-    // deref() will be called in clear().
-    m_mode = KeepAliveWhilePending;
-    ref();
+    // Keep |this| around while the promise is Pending;
+    // see clear() for the dual operation.
+    m_keepAlive = this;
 }
 
 void ScriptPromiseResolver::onTimerFired(Timer<ScriptPromiseResolver>*)
@@ -81,21 +79,10 @@ void ScriptPromiseResolver::clear()
 {
     if (m_state == ResolvedOrRejected)
         return;
-    ResolutionState state = m_state;
     m_state = ResolvedOrRejected;
     m_resolver.clear();
     m_value.clear();
-    if (m_mode == KeepAliveWhilePending) {
-        // |ref| was called in |keepAliveWhilePending|.
-        deref();

[haraken, 2015/07/17 01:40:35]

So my proposal is to keep this deref() (which is realized by
RefCountedGarbageCollected)...

-    }
-    // |this| may be deleted here, but it is safe to check |state| because
-    // it doesn't depend on |this|. When |this| is deleted, |state| can't be
-    // |Resolving| nor |Rejecting| and hence |this->deref()| can't be executed.
-    if (state == Resolving || state == Rejecting) {
-        // |ref| was called in |resolveOrReject|.
-        deref();

[haraken, 2015/07/17 01:40:35]

but remove this deref().

-    }
+    m_keepAlive.clear();
 }
 
 DEFINE_TRACE(ScriptPromiseResolver)