Couple V8AbstractEventListener's lifetime to the V8 listeners lifetime

third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp

Index: third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
index a8c1c700380a0fd7413c5298a9c25f9b923ce0f2..897f6da78a8fb455bcd3902a5523c0ed69c9205c 100644
--- a/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp
@@ -55,12 +55,7 @@ V8AbstractEventListener::V8AbstractEventListener(bool isAttribute, DOMWrapperWor
 
 V8AbstractEventListener::~V8AbstractEventListener()
 {
-    if (!m_listener.isEmpty()) {

[sof, 2015/11/24 08:19:04]

Zooming out here a bit.. simple question: what goes wrong if you don't clear the
wrapper on an empty context() ?

[jochen (gone - plz use gerrit), 2015/11/24 08:24:30]

the problem is that the m_scriptStateForListener turns out to be a random script
state, and not the one the listener was created in.

-        v8::HandleScope scope(isolate());
-        // We can't use a ScriptState::Scope here as the per-context data might already be gone at this point.
-        v8::Context::Scope contextScope(m_scriptStateForListener->context());
-        V8EventListenerList::clearWrapper(m_listener.newLocal(isolate()), m_isAttribute, m_scriptStateForListener.get());
-    }
+    ASSERT(m_listener.isEmpty());
     if (isMainThread())
         InstanceCounters::decrementCounter(InstanceCounters::JSEventListenerCounter);
 }
@@ -102,11 +97,17 @@ void V8AbstractEventListener::handleEvent(ScriptState* scriptState, Event* event
     invokeEventHandler(scriptState, event, v8::Local<v8::Value>::New(isolate(), jsEvent));
 }
 
-void V8AbstractEventListener::setListenerObject(v8::Local<v8::Object> listener, ScriptState* scriptState)
+void V8AbstractEventListener::setListenerObject(v8::Local<v8::Object> listener)
 {
+    ASSERT(m_listener.isEmpty());
+    // Balanced in secondWeakCallback xor clearListenerObject.
+#if ENABLE(OILPAN)
+    m_keepAlive = this;
+#else
+    ref();
+#endif
     m_listener.set(isolate(), listener);
     m_listener.setWeak(this, &setWeakCallback);
-    m_scriptStateForListener = scriptState;
 }
 
 void V8AbstractEventListener::invokeEventHandler(ScriptState* scriptState, Event* event, v8::Local<v8::Value> jsEvent)
@@ -184,10 +185,30 @@ bool V8AbstractEventListener::belongsToTheCurrentWorld() const
     return ScriptState::hasCurrentScriptState(isolate()) && &world() == &DOMWrapperWorld::current(isolate());
 }
 
-void V8AbstractEventListener::setWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener> &data)
+void V8AbstractEventListener::clearListenerObject()
+{
+    ASSERT(!m_listener.isEmpty());
+    m_listener.clear();
+#if ENABLE(OILPAN)
+    m_keepAlive.clear();
+#else
+    deref();
+#endif
+}
+
+void V8AbstractEventListener::setWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>& data)
 {
     data.GetParameter()->m_listener.clear();
-    data.GetParameter()->m_scriptStateForListener.clear();
+    data.SetSecondPassCallback(secondWeakCallback);
+}
+
+void V8AbstractEventListener::secondWeakCallback(const v8::WeakCallbackInfo<V8AbstractEventListener>& data)
+{
+#if ENABLE(OILPAN)
+    data.GetParameter()->m_keepAlive.clear();
+#else
+    data.GetParameter()->deref();
+#endif
 }
 
 } // namespace blink