Fix Document leak from NodeFilter.

Source/bindings/v8/custom/V8DocumentCustom.cpp

Index: Source/bindings/v8/custom/V8DocumentCustom.cpp
diff --git a/Source/bindings/v8/custom/V8DocumentCustom.cpp b/Source/bindings/v8/custom/V8DocumentCustom.cpp
index 7431fd7f9cb22815875354b31f2d902f20dd4adc..2835005d5f6045a12defd3ad82e331c6d0a14ed0 100644
--- a/Source/bindings/v8/custom/V8DocumentCustom.cpp
+++ b/Source/bindings/v8/custom/V8DocumentCustom.cpp
@@ -35,9 +35,12 @@
 #include "V8DOMImplementation.h"
 #include "V8HTMLDocument.h"
 #include "V8Node.h"
+#include "V8NodeFilter.h"
+#include "V8NodeIterator.h"
 #include "V8SVGDocument.h"
 #include "V8Touch.h"
 #include "V8TouchList.h"
+#include "V8TreeWalker.h"
 #include "V8WebGLRenderingContext.h"
 #include "V8XPathNSResolver.h"
 #include "V8XPathResult.h"
@@ -45,6 +48,8 @@
 #include "bindings/v8/ScriptController.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/V8DOMWrapper.h"
+#include "bindings/v8/V8HiddenPropertyName.h"
+#include "bindings/v8/V8NodeFilterCondition.h"
 #include "bindings/v8/V8WindowShell.h"
 #include "bindings/v8/custom/V8CustomXPathNSResolver.h"
 #include "core/dom/Document.h"
@@ -116,4 +121,79 @@ void V8Document::createTouchListMethodCustom(const v8::FunctionCallbackInfo<v8::
     v8SetReturnValue(args, toV8(touchList.release(), args.Holder(), args.GetIsolate()));
 }
 
+namespace {
+
+PassRefPtr<NodeFilter> toNodeFilterWithWrapper(v8::Handle<v8::Object>* filterWrapper, v8::Handle<v8::Value> callback, v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)

[haraken, 2013/08/01 03:44:15]

I'd really want to avoid writing custom bindings here. Instead, we might want to
seek a way to auto-generate the code we need.

In my understanding, the point of the custom binding is that we add a hidden
reference from NodeIterator's wrapper to NodeFilter's wrapper. Maybe can we use
[GenerateIsReachable=owner] to add the reference (and thus avoid custom
bindings)? By using [GenerateIsReachable=owner] on interface X, you can
explicitly say that there is a reference from X::owner()'s wrapper to X's
wrapper. (See DOMImplementation.idl and HTMLCollection.idl for more detailss)

[kouhei (in TOK), 2013/08/01 05:09:58]

I had offline discussion with haraken. The conclusion is to modify the binding
generator so that equivalent code can be generated.

Neither [GenerateIsReachable=owner] nor [CustomOpaqueRoot] are likely to work
here, as they rely on Node* to work. Modifying V8GCController.cpp was also
considered, but it doesn't feel right to modify them for every case like this.
The most general solution to this problem is probably to modify the binding
generator.

I will come back on this CL after the binding generator is modified to support
this kind of wrapper reference.

+{
+    RefPtr<NodeFilter> filter = NodeFilter::create();
+    *filterWrapper = toV8(filter.get(), creationContext, isolate).As<v8::Object>();
+
+    RefPtr<NodeFilterCondition> condition = V8NodeFilterCondition::create(callback, *filterWrapper);
+    filter->setCondition(condition.release());
+
+    return filter.release();
+}
+
+} // namespace
+
+void V8Document::createNodeIteratorMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& args)
+{
+    if (args.Length() < 1) {
+        throwNotEnoughArgumentsError(args.GetIsolate());
+        return;
+    }
+
+    Document* document = V8Document::toNative(args.Holder());
+    ExceptionState es(args.GetIsolate());
+
+    V8TRYCATCH_VOID(Node*, root, V8Node::HasInstance(args[0], args.GetIsolate(), worldType(args.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0);
+    V8TRYCATCH_VOID(unsigned, whatToShow, (args.Length() > 2) ? toUInt32(args[1]) : NodeFilter::SHOW_ALL);
+
+    v8::Handle<v8::Object> filterWrapper;
+    RefPtr<NodeFilter> filter;
+    if (args.Length() > 3)
+        filter = toNodeFilterWithWrapper(&filterWrapper, args[2], args.Holder(), args.GetIsolate());
+
+    V8TRYCATCH_VOID(bool, expandEntityReferences, args[3]->BooleanValue());
+
+    RefPtr<NodeIterator> nodeIterator = document->createNodeIterator(root, whatToShow, filter.get(), expandEntityReferences, es);
+    if (es.throwIfNeeded())
+        return;
+
+    v8::Handle<v8::Object> nodeIteratorWrapper = toV8Fast(nodeIterator.get(), args, document).As<v8::Object>();
+    if (!filterWrapper.IsEmpty())
+        V8HiddenPropertyName::setNamedHiddenReference(nodeIteratorWrapper, "filter", filterWrapper);
+    v8SetReturnValue(args, nodeIteratorWrapper);
+}
+
+void V8Document::createTreeWalkerMethodCustom(const v8::FunctionCallbackInfo<v8::Value>& args)
+{
+    if (args.Length() < 1) {
+        throwNotEnoughArgumentsError(args.GetIsolate());
+        return;
+    }
+
+    Document* document = V8Document::toNative(args.Holder());
+    ExceptionState es(args.GetIsolate());
+
+    V8TRYCATCH_VOID(Node*, root, V8Node::HasInstance(args[0], args.GetIsolate(), worldType(args.GetIsolate())) ? V8Node::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0);
+    V8TRYCATCH_VOID(unsigned, whatToShow, (args.Length() > 2) ? toUInt32(args[1]) : NodeFilter::SHOW_ALL);
+
+    v8::Handle<v8::Object> filterWrapper;
+    RefPtr<NodeFilter> filter;
+    if (args.Length() > 3)
+        filter = toNodeFilterWithWrapper(&filterWrapper, args[2], args.Holder(), args.GetIsolate());
+
+    V8TRYCATCH_VOID(bool, expandEntityReferences, args[3]->BooleanValue());
+
+    RefPtr<TreeWalker> treeWalker = document->createTreeWalker(root, whatToShow, filter.get(), expandEntityReferences, es);
+    if (es.throwIfNeeded())
+        return;
+
+    v8::Handle<v8::Object> treeWalkerWrapper = toV8Fast(treeWalker.get(), args, document).As<v8::Object>();
+    if (!filterWrapper.IsEmpty())
+        V8HiddenPropertyName::setNamedHiddenReference(treeWalkerWrapper, "filter", filterWrapper);
+    v8SetReturnValue(args, treeWalkerWrapper);
+}
+
 } // namespace WebCore