[wrapper-tracing] Avoid GC during PostMessageTimer construction

third_party/WebKit/Source/core/frame/LocalDOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 607 matching lines @@
     m_navigator = Navigator::create(frame());
   return m_navigator.get();
 }
 
 void LocalDOMWindow::schedulePostMessage(MessageEvent* event,
                                          PassRefPtr<SecurityOrigin> target,
                                          Document* source) {
   // Allowing unbounded amounts of messages to build up for a suspended context
   // is problematic; consider imposing a limit or other restriction if this
   // surfaces often as a problem (see crbug.com/587012).
-  PostMessageTimer* timer = new PostMessageTimer(
-      *this, event, std::move(target), SourceLocation::capture(source),
-      UserGestureIndicator::currentToken());
+  std::unique_ptr<SourceLocation> location = SourceLocation::capture(source);

[sof, 2016/11/29 09:15:44]

Subtle staging of allocations going on here wrt 'new'; an explanatory comment
covering why the allocation needs to be lifted out, would have been helpful.

Even better, following the standard pattern of having a create() factory method
would have prevented the problem from arising, i think.

[Michael Lippautz, 2016/11/29 09:51:41]

Sorry, for not leaving a comment. The rationale is that we cannot call into V8
from a gcForbidden scope, because V8 can now trace through blink, effectively
requiring some of its marking infrastructure.
I will add (D)CHECKs that would immediately fail (even without triggering a GC)
when calling into V8 from such scopes. Only those call sites require
refactoring. 

Using ::create might mitigate this scenario, but people could still call it from
ctors before vtable poitners are available.

+  PostMessageTimer* timer =
+      new PostMessageTimer(*this, event, std::move(target), std::move(location),
+                           UserGestureIndicator::currentToken());
   timer->startOneShot(0, BLINK_FROM_HERE);
   timer->suspendIfNeeded();
   m_postMessageTimers.add(timer);
 }
 
 void LocalDOMWindow::postMessageTimerFired(PostMessageTimer* timer) {
   if (!isCurrentlyDisplayedInFrame())
     return;
 
   MessageEvent* event = timer->event();
@@ skipping 921 matching lines @@
 
 LocalFrame* LocalDOMWindow::frame() const {
   // If the LocalDOMWindow still has a frame reference, that frame must point
   // back to this LocalDOMWindow: otherwise, it's easy to get into a situation
   // where script execution leaks between different LocalDOMWindows.
   SECURITY_DCHECK(!m_frame || m_frame->domWindow() == this);
   return m_frame;
 }
 
 }  // namespace blink