Oilpan: move WorkerGlobalScope to oilpan's heap.

Source/core/workers/WorkerThread.cpp

 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 119 matching lines @@
     m_workerReportingProxy.workerGlobalScopeStarted(m_workerGlobalScope.get());
 
     WorkerScriptController* script = m_workerGlobalScope->script();
     InspectorInstrumentation::willEvaluateWorkerScript(workerGlobalScope(), startMode);
     script->evaluate(ScriptSourceCode(sourceCode, scriptURL));
 
     runEventLoop();
 
     ThreadIdentifier threadID = m_threadID;
 
+#if !ENABLE(OILPAN)
     ASSERT(m_workerGlobalScope->hasOneRef());

[jochen (gone - plz use gerrit), 2014/02/28 08:26:06]

note that this ASSERT() does not hold. The ref count at this point is sometimes
one and sometimes two.

Layout tests just happen to not trigger this assert.

No idea who holds the second ref, I suspect it's a threadable loader.

[sof, 2014/02/28 08:32:52]

I see. Has it proven useful to catch out bugs in the past?

[jochen (gone - plz use gerrit), 2014/02/28 08:35:46]

It clearly indicates that there's a bug. Nobody caught it yet.

[sof, 2014/02/28 08:39:25]

Is there a bug on it already?

+#endif
 
     // The below assignment will destroy the context, which will in turn notify messaging proxy.
     // We cannot let any objects survive past thread exit, because no other thread will run GC or otherwise destroy them.
+    m_workerGlobalScope->detach();
     m_workerGlobalScope = nullptr;
 
     // Cleanup thread heap which causes all objects to be finalized.
     // After this call thread heap must be empty.
     ThreadState::current()->cleanup();
 
     // Clean up PlatformThreadData before WTF::WTFThreadData goes away!
     PlatformThreadData::current().destroy();
 
     // The thread object may be already destroyed from notification now, don't try to access "this".
@@ skipping 94 matching lines @@
 void WorkerThread::releaseFastMallocFreeMemoryInAllThreads()
 {
     MutexLocker lock(threadSetMutex());
     HashSet<WorkerThread*>& threads = workerThreads();
     HashSet<WorkerThread*>::iterator end = threads.end();
     for (HashSet<WorkerThread*>::iterator it = threads.begin(); it != end; ++it)
         (*it)->runLoop().postTask(adoptPtr(new ReleaseFastMallocFreeMemoryTask));
 }
 
 } // namespace WebCore