Do not use weak handles for ArrayBuffers.

src/heap.cc

Index: src/heap.cc
diff --git a/src/heap.cc b/src/heap.cc
index 5710b634be1e73d8ae73aab191e8c5c04c7b06cb..fa5b54c27616261bfad49b4778aa1c24b7cbab3a 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -1569,6 +1569,8 @@ static Object* VisitWeakList(Heap* heap,
       // tail is a live object, visit it.
       WeakListVisitor<T>::VisitLiveObject(
           heap, tail, retainer, record_slots);
+    } else {
+      WeakListVisitor<T>::VisitPhantomObject(heap, candidate);
     }
 
     // Move to next element in the list.
@@ -1600,6 +1602,9 @@ struct WeakListVisitor<JSFunction> {
   static void VisitLiveObject(Heap*, JSFunction*,
                               WeakObjectRetainer*, bool) {
   }
+
+  static void VisitPhantomObject(Heap*, JSFunction*) {
+  }
 };
 
 
@@ -1638,6 +1643,9 @@ struct WeakListVisitor<Context> {
     }
   }
 
+  static void VisitPhantomObject(Heap*, Context*) {
+  }
+
   static int WeakNextOffset() {
     return FixedArray::SizeFor(Context::NEXT_CONTEXT_LINK);
   }
@@ -1681,6 +1689,8 @@ struct WeakListVisitor<JSTypedArray> {
                               WeakObjectRetainer* retainer,
                               bool record_slots) {}
 
+  static void VisitPhantomObject(Heap*, JSTypedArray*) {}
+
   static int WeakNextOffset() {
     return JSTypedArray::kWeakNextOffset;
   }
@@ -1714,6 +1724,10 @@ struct WeakListVisitor<JSArrayBuffer> {
     }
   }
 
+  static void VisitPhantomObject(Heap* heap, JSArrayBuffer* phantom) {
+    Runtime::FreeArrayBuffer(heap->isolate(), phantom);
+  }
+
   static int WeakNextOffset() {
     return JSArrayBuffer::kWeakNextOffset;
   }
@@ -1729,6 +1743,16 @@ void Heap::ProcessArrayBuffers(WeakObjectRetainer* retainer,
   set_array_buffers_list(array_buffer_obj);
 }
 

[Michael Starzinger, 2013/06/19 11:35:09]

nit: Add a second empty newline.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+void Heap::TearDownArrayBuffers() {
+  Object* undefined = undefined_value();
+  for (Object* o = array_buffers_list();

[Michael Starzinger, 2013/06/19 11:35:09]

nit: Should fit into one line.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+       o != undefined;) {
+    JSArrayBuffer* buffer = JSArrayBuffer::cast(o);
+    Runtime::FreeArrayBuffer(isolate(), buffer);
+    o = buffer->weak_next();
+  }

[Michael Starzinger, 2013/06/19 11:35:09]

Let's play it safe and reset array_buffers_list to undefined here.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+}
+
 
 void Heap::VisitExternalResources(v8::ExternalResourceVisitor* visitor) {
   DisallowHeapAllocation no_allocation;
@@ -6869,6 +6893,8 @@ void Heap::TearDown() {
     PrintF("\n\n");
   }
 
+  TearDownArrayBuffers();
+
   isolate_->global_handles()->TearDown();
 
   external_string_table_.TearDown();