Harden ScriptWrappable against ref count bugs

Source/bindings/v8/ScriptWrappable.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 128 matching lines @@
 
     template<typename T>
     static bool setReturnValue(v8::ReturnValue<v8::Value> returnValue, T* object)
     {
         return ScriptWrappable::getUnsafeWrapperFromObject(object).setReturnValue(returnValue);
     }
 
 protected:
     ~ScriptWrappable()
     {
+        // We must not get deleted as long as we contain a wrapper. If this happens, we screwed up ref
+        // counting somewhere. Crash here instead of crashing during a later gc cycle.
+        RELEASE_ASSERT_WITH_SECURITY_IMPLICATION(!containsWrapper());
         ASSERT(m_wrapperOrTypeInfo);  // Assert initialization via init() even if not subsequently wrapped.
         m_wrapperOrTypeInfo = 0;      // Break UAF attempts to wrap.
     }
 
 private:
     // For calling unsafePersistent and getWrapperFromObject.
     friend class MinorGCWrapperVisitor;
     friend class DOMDataStore;
 
     UnsafePersistent<v8::Object> unsafePersistent() const
@@ skipping 37 matching lines @@
         // FIXME: I noticed that 50%~ of minor GC cycle times can be consumed
         // inside data.GetParameter()->deref(), which causes Node destructions. We should
         // make Node destructions incremental.
         releaseObject(data.GetValue());
     }
 };
 
 } // namespace WebCore
 
 #endif // ScriptWrappable_h