Have ScriptPromiseResolver on the Oilpan heap always.

Source/bindings/core/v8/ScriptPromiseResolver.cpp

Index: Source/bindings/core/v8/ScriptPromiseResolver.cpp
diff --git a/Source/bindings/core/v8/ScriptPromiseResolver.cpp b/Source/bindings/core/v8/ScriptPromiseResolver.cpp
index 993484f0865a734fe644aefbbdcef170f107017f..42f0b7da600d539b356d7f5ad4681d76566d8fd5 100644
--- a/Source/bindings/core/v8/ScriptPromiseResolver.cpp
+++ b/Source/bindings/core/v8/ScriptPromiseResolver.cpp
@@ -14,7 +14,6 @@ ScriptPromiseResolver::ScriptPromiseResolver(ScriptState* scriptState)
     : ActiveDOMObject(scriptState->executionContext())
     , m_state(Pending)
     , m_scriptState(scriptState)
-    , m_mode(Default)
     , m_timer(this, &ScriptPromiseResolver::onTimerFired)
     , m_resolver(scriptState)
 #if ENABLE(ASSERT)
@@ -46,13 +45,12 @@ void ScriptPromiseResolver::stop()
 
 void ScriptPromiseResolver::keepAliveWhilePending()
 {
-    if (m_state == ResolvedOrRejected || m_mode == KeepAliveWhilePending)
+    if (m_state == ResolvedOrRejected || m_keepAlive)

[haraken, 2015/07/18 08:01:23]

Instead of adding '|| m_keepAlive', can we add ASSERT(!m_keepAlive)?

[sof, 2015/07/18 20:46:08]

I don't think that's accurate - how do you reason to suggest that here?

i.e., consider MIDIAccessInitializer::start() being called with an execution
context in a suspended state. It'll set m_keepAlive. start() may then progress
and try to call reject() (say), where ScriptPromiseResolver will call
keepAliveWhilePending() again (via resolveOrReject()). m_keepAlive will then be
set.

[haraken, 2015/07/19 07:25:50]

Makes sense! Would be worth having a comment -- keepAliveWhilePending can be
called multiple times but those are expected to be cleared with one clear()
call.

[sof, 2015/07/20 11:01:43]

Added clarifying comment.

         return;
 
-    // Keep |this| while the promise is Pending.
-    // deref() will be called in clear().
-    m_mode = KeepAliveWhilePending;
-    ref();
+    // Keep |this| around while the promise is Pending;
+    // see clear() for the dual operation.
+    m_keepAlive = this;
 }
 
 void ScriptPromiseResolver::onTimerFired(Timer<ScriptPromiseResolver>*)
@@ -81,21 +79,10 @@ void ScriptPromiseResolver::clear()
 {
     if (m_state == ResolvedOrRejected)
         return;
-    ResolutionState state = m_state;
     m_state = ResolvedOrRejected;
     m_resolver.clear();
     m_value.clear();
-    if (m_mode == KeepAliveWhilePending) {
-        // |ref| was called in |keepAliveWhilePending|.
-        deref();
-    }
-    // |this| may be deleted here, but it is safe to check |state| because
-    // it doesn't depend on |this|. When |this| is deleted, |state| can't be
-    // |Resolving| nor |Rejecting| and hence |this->deref()| can't be executed.
-    if (state == Resolving || state == Rejecting) {
-        // |ref| was called in |resolveOrReject|.
-        deref();
-    }
+    m_keepAlive.clear();
 }
 
 DEFINE_TRACE(ScriptPromiseResolver)