Wrapper tracing Document::m_nodeLists leaks node lists

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 4208 matching lines @@
 }
 
 void Document::setCSSTarget(Element* newTarget) {
   if (m_cssTarget)
     m_cssTarget->pseudoStateChanged(CSSSelector::PseudoTarget);
   m_cssTarget = newTarget;
   if (m_cssTarget)
     m_cssTarget->pseudoStateChanged(CSSSelector::PseudoTarget);
 }
 
-static void liveNodeListBaseWriteBarrier(void* parent,
-                                         const LiveNodeListBase* list) {
-  if (isHTMLCollectionType(list->type())) {
-    ScriptWrappableVisitor::writeBarrier(
-        parent, static_cast<const HTMLCollection*>(list));
-  } else {
-    ScriptWrappableVisitor::writeBarrier(
-        parent, static_cast<const LiveNodeList*>(list));
-  }
-}
-
 void Document::registerNodeList(const LiveNodeListBase* list) {
   DCHECK(!m_nodeLists[list->invalidationType()].contains(list));
   m_nodeLists[list->invalidationType()].insert(list);
-  liveNodeListBaseWriteBarrier(this, list);
   if (list->isRootedAtTreeScope())
     m_listsInvalidatedAtDocument.insert(list);
 }
 
 void Document::unregisterNodeList(const LiveNodeListBase* list) {
   DCHECK(m_nodeLists[list->invalidationType()].contains(list));
   m_nodeLists[list->invalidationType()].erase(list);
   if (list->isRootedAtTreeScope()) {
     DCHECK(m_listsInvalidatedAtDocument.contains(list));
     m_listsInvalidatedAtDocument.erase(list);
   }
 }
 
 void Document::registerNodeListWithIdNameCache(const LiveNodeListBase* list) {
   DCHECK(!m_nodeLists[InvalidateOnIdNameAttrChange].contains(list));
   m_nodeLists[InvalidateOnIdNameAttrChange].insert(list);
-  liveNodeListBaseWriteBarrier(this, list);
 }
 
 void Document::unregisterNodeListWithIdNameCache(const LiveNodeListBase* list) {
   DCHECK(m_nodeLists[InvalidateOnIdNameAttrChange].contains(list));
   m_nodeLists[InvalidateOnIdNameAttrChange].erase(list);
 }
 
 void Document::attachNodeIterator(NodeIterator* ni) {
   m_nodeIterators.insert(ni);
 }
@@ skipping 2307 matching lines @@
   for (int i = m_wouldLoadReason + 1; i <= reason; ++i)
     recordLoadReasonToHistogram(static_cast<WouldLoadReason>(i));
   m_wouldLoadReason = reason;
 }
 
 DEFINE_TRACE_WRAPPERS(Document) {
   visitor->traceWrappers(m_importsController);
   visitor->traceWrappers(m_implementation);
   visitor->traceWrappers(m_styleSheetList);
   visitor->traceWrappers(m_styleEngine);
-  for (int i = 0; i < numNodeListInvalidationTypes; ++i) {
-    for (auto list : m_nodeLists[i]) {
-      if (isHTMLCollectionType(list->type())) {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const HTMLCollection*>(list.get()));
-      } else {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const LiveNodeList*>(list.get()));
-      }
-    }
-  }
   // Cannot trace in Supplementable<Document> as it is part of platform/ and
   // thus cannot refer to ScriptWrappableVisitor.
   visitor->traceWrappers(
       static_cast<FontFaceSet*>(Supplementable<Document>::m_supplements.at(
           FontFaceSet::supplementName())));
   ContainerNode::traceWrappers(visitor);
 }
 
 template class CORE_TEMPLATE_EXPORT Supplement<Document>;
 
 }  // namespace blink
 
 #ifndef NDEBUG
 static WeakDocumentSet& liveDocumentSet() {
   DEFINE_STATIC_LOCAL(WeakDocumentSet, set, ());
   return set;
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (blink::Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif