Oilpan: move Touch related objects to the oilpan heap.

Source/bindings/v8/V8Binding.h

Index: Source/bindings/v8/V8Binding.h
diff --git a/Source/bindings/v8/V8Binding.h b/Source/bindings/v8/V8Binding.h
index 86602d66f86fb6077ef4df698950292d8c716adc..f6eeb416f7f839b4bd941b521a3bf7da724debf7 100644
--- a/Source/bindings/v8/V8Binding.h
+++ b/Source/bindings/v8/V8Binding.h
@@ -471,6 +471,8 @@ struct NativeValueTraits<v8::Handle<v8::Value> > {
     }
 };
 
+v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value>, uint32_t& length, v8::Isolate*);
+
 // Converts a JavaScript value to an array as per the Web IDL specification:
 // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-array
 template <class T, class V8T>
@@ -494,7 +496,26 @@ Vector<RefPtr<T> > toRefPtrNativeArrayUnchecked(v8::Local<v8::Value> v8Value, ui
     return result;
 }
 
-v8::Handle<v8::Value> toV8Sequence(v8::Handle<v8::Value>, uint32_t& length, v8::Isolate*);
+template <class T, class V8T>
+HeapVector<Member<T> > toMemberNativeArrayUnchecked(v8::Local<v8::Value> v8Value, uint32_t length, v8::Isolate* isolate, bool* success = 0)
+{
+    HeapVector<Member<T> > result;

[haraken, 2014/03/05 14:52:46]

Would you add:

  if (success)
    *success = true;

?

[sof, 2014/03/05 16:01:12]

Indirectly done by inlining the Unchecked() version into toMemberNativeArray()
(its only caller.)

+    result.reserveInitialCapacity(length);
+    v8::Local<v8::Object> object = v8::Local<v8::Object>::Cast(v8Value);
+    for (uint32_t i = 0; i < length; ++i) {
+        v8::Handle<v8::Value> element = object->Get(i);
+        if (V8T::hasInstance(element, isolate)) {
+            v8::Handle<v8::Object> elementObject = v8::Handle<v8::Object>::Cast(element);
+            result.uncheckedAppend(V8T::toNative(elementObject));
+        } else {
+            if (success)
+                *success = false;
+            throwTypeError("Invalid Array element type", isolate);
+            return HeapVector<Member<T> >();
+        }
+    }
+    return result;
+}
 
 template <class T, class V8T>
 Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, bool* success = 0)
@@ -530,6 +551,24 @@ Vector<RefPtr<T> > toRefPtrNativeArray(v8::Handle<v8::Value> value, const String
     return toRefPtrNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, success);
 }
 
+template <class T, class V8T>
+HeapVector<Member<T> > toMemberNativeArray(v8::Handle<v8::Value> value, int argumentIndex, v8::Isolate* isolate, bool* success = 0)
+{
+    if (success)
+        *success = true;
+
+    v8::Local<v8::Value> v8Value(v8::Local<v8::Value>::New(isolate, value));
+    uint32_t length = 0;
+    if (value->IsArray()) {
+        length = v8::Local<v8::Array>::Cast(v8Value)->Length();
+    } else if (toV8Sequence(value, length, isolate).IsEmpty()) {
+        throwTypeError(ExceptionMessages::notAnArrayTypeArgumentOrValue(argumentIndex), isolate);
+        return HeapVector<Member<T> >();
+    }
+
+    return toMemberNativeArrayUnchecked<T, V8T>(v8Value, length, isolate, success);
+}
+
 // Converts a JavaScript value to an array as per the Web IDL specification:
 // http://www.w3.org/TR/2012/CR-WebIDL-20120419/#es-array
 template <class T>