Oilpan: IDBCursor should be detached from IDBRequest when the IDBRequest stops

Source/bindings/v8/WorkerScriptController.cpp

 /*
  * Copyright (C) 2009, 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 84 matching lines @@
 
     v8::Isolate* m_isolate;
 };
 
 WorkerScriptController::~WorkerScriptController()
 {
     ThreadState::current()->removeInterruptor(m_interruptor.get());
 
     m_world->dispose();
 
-    // The corresponding call to didStartWorkerRunLoop is in
-    // WorkerThread::workerThread().
-    // See http://webkit.org/b/83104#c14 for why this is here.
+    // We need to collect all dead DOM objects before calling didStopWorkerRunLoop(),
+    // because destructors of some DOM objects touch Chromium-side objects
+    // which are destroyed in didStopWorkerRunLoop(). For example, ~IDBRequest() touches
+    // IndexedDBDispatcher which is destroyed in didStopWorkerRunLoop().
+    //
+    // Things should happen in the following order:
+    // (1) Heap::collectAllGarbage()
+    // (2) didStopWorkerRunLoop()
+    // (3) ThreadState::detach()

[zerny-chromium, 2014/03/31 06:33:10]

This also does a full GC. Do we need this both before and after
didStopWorkerRunLoop?

[Mads Ager (chromium), 2014/03/31 08:56:53]

So, we definitely need the detach call and we have to have that where it is now.
It would be really nice if we could make the worker thread invalidate IDBCursors
at this point instead. Maybe we can have a per worker thread weak set of
IDBCursors that we can iterate at this point and invalidate (clear out their
OwnPtr). That is the only thing we actually care about here and therefore,
performing a full garbage collection on all threads in order to invalidate the
(probably very few if any) IDBCursors on this thread seems very heavy weight.

+    // (4) Isolate destruction
+    // See http://webkit.org/b/83104#c14 for more details.
+    Heap::collectAllGarbage(ThreadState::NoHeapPointersOnStack);
+
+    // The corresponding call to didStartWorkerRunLoop is in WorkerThread::workerThread().
     blink::Platform::current()->didStopWorkerRunLoop(blink::WebWorkerRunLoop(&m_workerGlobalScope.thread()->runLoop()));
 
     disposeContext();
 
     ThreadState::current()->addCleanupTask(IsolateCleanupTask::create(m_isolate));
 }
 
 void WorkerScriptController::disposeContext()
 {
     m_perContextData.clear();
@@ skipping 139 matching lines @@
     m_disableEvalPending = errorMessage;
 }
 
 void WorkerScriptController::rethrowExceptionFromImportedScript(PassRefPtr<ErrorEvent> errorEvent)
 {
     m_errorEventFromImportedScript = errorEvent;
     throwError(V8ThrowException::createError(v8GeneralError, m_errorEventFromImportedScript->message(), m_isolate), m_isolate);
 }
 
 } // namespace WebCore