Oilpan: IDBCursor should be detached from IDBRequest when the IDBRequest stops

Source/bindings/v8/WorkerScriptController.cpp

Index: Source/bindings/v8/WorkerScriptController.cpp
diff --git a/Source/bindings/v8/WorkerScriptController.cpp b/Source/bindings/v8/WorkerScriptController.cpp
index 6127764871bf72ad64238da0085237b601cbcfd7..0c2174258e179ade3199248f68cd5c0764bd2bdc 100644
--- a/Source/bindings/v8/WorkerScriptController.cpp
+++ b/Source/bindings/v8/WorkerScriptController.cpp
@@ -102,9 +102,20 @@ WorkerScriptController::~WorkerScriptController()
 
     m_world->dispose();
 
-    // The corresponding call to didStartWorkerRunLoop is in
-    // WorkerThread::workerThread().
-    // See http://webkit.org/b/83104#c14 for why this is here.
+    // We need to collect all dead DOM objects before calling didStopWorkerRunLoop(),
+    // because destructors of some DOM objects touch Chromium-side objects
+    // which are destroyed in didStopWorkerRunLoop(). For example, ~IDBRequest() touches
+    // IndexedDBDispatcher which is destroyed in didStopWorkerRunLoop().
+    //
+    // Things should happen in the following order:
+    // (1) Heap::collectAllGarbage()
+    // (2) didStopWorkerRunLoop()
+    // (3) ThreadState::detach()

[zerny-chromium, 2014/03/31 06:33:10]

This also does a full GC. Do we need this both before and after
didStopWorkerRunLoop?

[Mads Ager (chromium), 2014/03/31 08:56:53]

So, we definitely need the detach call and we have to have that where it is now.
It would be really nice if we could make the worker thread invalidate IDBCursors
at this point instead. Maybe we can have a per worker thread weak set of
IDBCursors that we can iterate at this point and invalidate (clear out their
OwnPtr). That is the only thing we actually care about here and therefore,
performing a full garbage collection on all threads in order to invalidate the
(probably very few if any) IDBCursors on this thread seems very heavy weight.

+    // (4) Isolate destruction
+    // See http://webkit.org/b/83104#c14 for more details.
+    Heap::collectAllGarbage(ThreadState::NoHeapPointersOnStack);
+
+    // The corresponding call to didStartWorkerRunLoop is in WorkerThread::workerThread().
     blink::Platform::current()->didStopWorkerRunLoop(blink::WebWorkerRunLoop(&m_workerGlobalScope.thread()->runLoop()));
 
     disposeContext();