bindings/oilpan: Stops using ScriptWrappable pointers already collected by GC.

Source/bindings/core/v8/ScriptWrappable.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 162 matching lines @@
     void disposeWrapper(const v8::WeakCallbackInfo<ScriptWrappable>& data)
     {
         auto scriptWrappable = reinterpret_cast<ScriptWrappable*>(data.GetInternalField(v8DOMWrapperObjectIndex));
         RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(scriptWrappable == this);
         RELEASE_ASSERT(containsWrapper());
         m_wrapper.Reset();
     }
 
     static void firstWeakCallback(const v8::WeakCallbackInfo<ScriptWrappable>& data)
     {
-        data.GetParameter()->disposeWrapper(data);
-        data.SetSecondPassCallback(secondWeakCallback);
+        auto scriptWrappable = data.GetParameter();
+        scriptWrappable->disposeWrapper(data);
+
+        auto wrapperTypeInfo = reinterpret_cast<WrapperTypeInfo*>(data.GetInternalField(v8DOMWrapperTypeIndex));
+        if (wrapperTypeInfo->isGarbageCollected()) {
+            // derefObject() for garbage collected objects is very cheap, so
+            // we don't delay derefObject to the second pass.
+            //
+            // More importantly, we've already disposed the wrapper at this
+            // moment, so the ScriptWrappable may have already been collected
+            // by GC by the second pass.  We shouldn't use a pointer to the
+            // ScriptWrappable in secondWeakCallback in case of garbage
+            // collected objects.  Thus calls derefObject right now.
+            wrapperTypeInfo->derefObject(scriptWrappable);
+        } else {
+            // For reference counted objects, let's delay the destruction of
+            // the object to the second pass.
+            data.SetSecondPassCallback(secondWeakCallback);
+        }
     }
 
     static void secondWeakCallback(const v8::WeakCallbackInfo<ScriptWrappable>& data)
     {
         // FIXME: I noticed that 50%~ of minor GC cycle times can be consumed
         // inside data.GetParameter()->deref(), which causes Node destructions. We should
         // make Node destructions incremental.
         auto scriptWrappable = reinterpret_cast<ScriptWrappable*>(data.GetInternalField(v8DOMWrapperObjectIndex));
-        auto typeInfo = reinterpret_cast<WrapperTypeInfo*>(data.GetInternalField(v8DOMWrapperTypeIndex));
-        typeInfo->derefObject(scriptWrappable);
+        auto wrapperTypeInfo = reinterpret_cast<WrapperTypeInfo*>(data.GetInternalField(v8DOMWrapperTypeIndex));
+        wrapperTypeInfo->derefObject(scriptWrappable);
     }
 
     v8::Persistent<v8::Object> m_wrapper;
 };
 
 // Defines 'wrapperTypeInfo' virtual method which returns the WrapperTypeInfo of
 // the instance. Also declares a static member of type WrapperTypeInfo, of which
 // the definition is given by the IDL code generator.
 //
 // All the derived classes of ScriptWrappable, regardless of directly or
 // indirectly, must write this macro in the class definition as long as the
 // class has a corresponding .idl file.
-#define DEFINE_WRAPPERTYPEINFO()                \
+#define DEFINE_WRAPPERTYPEINFO() \
 public: \
     const WrapperTypeInfo* wrapperTypeInfo() const override \
     { \
         return &s_wrapperTypeInfo; \
     } \
 private: \
     static const WrapperTypeInfo& s_wrapperTypeInfo
 
 // Defines 'wrapperTypeInfo' virtual method, which should never be called.
 //
@@ skipping 27 matching lines @@
 // in X's cpp code, and instantiate X, i.e. "template class X;".
 #define DECLARE_WRAPPERTYPEINFO() \
 public: \
     const WrapperTypeInfo* wrapperTypeInfo() const override; \
 private: \
     typedef void end_of_define_wrappertypeinfo_not_reached_t
 
 } // namespace blink
 
 #endif // ScriptWrappable_h