[oilpan] Resurrect a loop-back persistent handle in RefCountedHeapAllocated

Source/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 419 matching lines @@
 class RefCountedHeapAllocated : public RefCounted<T>, public HeapAllocatedFinalized<T> {
     WTF_MAKE_NONCOPYABLE(RefCountedHeapAllocated);
 
 public:
     RefCountedHeapAllocated()
     {
         ASSERT(Heap::contains(reinterpret_cast<Address>(this)));
         m_keepAlive = new Persistent<T>(static_cast<T*>(this));
     }
 
+    // Override ref to deal with a case where a reference count goes up
+    // from 0 to 1. This can happen in the following scenario:
+    // (1) The reference count becomes 0, but Handles have references to the object.
+    // (2) The Handle is assigned to a RefPtr. The reference count becomes 1.
+    // In this case, we have to resurrect m_keepAlive.
+    void ref()
+    {
+        if (UNLIKELY(!RefCounted<T>::refCount())) {
+            ASSERT(!m_keepAlive);
+            ASSERT(Heap::contains(reinterpret_cast<Address>(this)));
+            m_keepAlive = new Persistent<T>(static_cast<T*>(this));
+        }
+        RefCounted<T>::refBase();
+    }
+
     // Override deref to deal with our own deallocation based on ref counting.
     void deref()
     {
-        if (RefCounted<T>::derefBase())
+        if (RefCounted<T>::derefBase()) {
             delete m_keepAlive;
+            m_keepAlive = 0;
+        }
     }
 
     // For now we don't trace through things that are still ref counted, so
     // there is nothing to do in the accept method.
     void accept(Visitor*) { }
 
 protected:
     ~RefCountedHeapAllocated() { }
 
 private:
@@ skipping 105 matching lines @@
     // You can't mark an object that isn't in the heap.
     ASSERT(contains(header));
     // End of object should also be in the heap.
     ASSERT(contains(header->payloadEnd() - 1));
     header->mark();
 }
 
 } // namespace WebCore
 
 #endif