[oilpan] Resurrect a loop-back persistent handle in RefCountedHeapAllocated

Source/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Heap_h
 #define Heap_h
 
 #include "heap/Visitor.h"
 #include <new>
 #include <stddef.h>
+#include <stdio.h>

[Mads Ager (chromium), 2013/05/29 16:46:38]

Remove.

[haraken, 2013/05/29 16:49:02]

Done.

 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
 const size_t pageSizeLog2 = 17;
 const size_t pageSize = 1 << pageSizeLog2;
 const size_t allocationGranularity = 8;
 const size_t allocationMask = allocationGranularity - 1;
@@ skipping 383 matching lines @@
 class RefCountedHeapAllocated : public RefCounted<T>, public HeapAllocatedFinalized<T> {
     WTF_MAKE_NONCOPYABLE(RefCountedHeapAllocated);
 
 public:
     RefCountedHeapAllocated()
     {
         ASSERT(Heap::contains(reinterpret_cast<Address>(this)));
         m_keepAlive = new Persistent<T>(static_cast<T*>(this));
     }
 
+    // Override ref to deal with a case where a reference count goes up
+    // from 0 to 1. This can happen in the following scenario:
+    // (1) The reference count becomes 0, but Handles keep references to the object.
+    // (2) The Handle is assigned to a RefPtr. The reference count becomes 1.
+    // In this case, we have to resurrect m_keepAlive.
+    void ref()
+    {
+        if (UNLIKELY(!RefCounted<T>::refCount())) {
+            ASSERT(!m_keepAlive);
+            ASSERT(Heap::contains(reinterpret_cast<Address>(this)));
+            m_keepAlive = new Persistent<T>(static_cast<T*>(this));
+        }
+        RefCounted<T>::refBase();
+    }
+
     // Override deref to deal with our own deallocation based on ref counting.
     void deref()
     {
-        if (RefCounted<T>::derefBase())
+        if (RefCounted<T>::derefBase()) {
             delete m_keepAlive;
+            m_keepAlive = 0;
+        }
     }
 
     // For now we don't trace through things that are still ref counted, so
     // there is nothing to do in the accept method.
     void accept(Visitor*) { }
 
 protected:
     ~RefCountedHeapAllocated() { }
 
 private:
@@ skipping 105 matching lines @@
     // You can't mark an object that isn't in the heap.
     ASSERT(contains(header));
     // End of object should also be in the heap.
     ASSERT(contains(header->payloadEnd() - 1));
     header->mark();
 }
 
 } // namespace WebCore
 
 #endif