Wrapper tracing Document::m_nodeLists leaks node lists

third_party/WebKit/Source/core/dom/Document.cpp

Index: third_party/WebKit/Source/core/dom/Document.cpp
diff --git a/third_party/WebKit/Source/core/dom/Document.cpp b/third_party/WebKit/Source/core/dom/Document.cpp
index e98e4b9b8d45b3c942d088fa676f03badbea7ef4..59098048bb45d7f645fd6ccbbf20407dd3bfd552 100644
--- a/third_party/WebKit/Source/core/dom/Document.cpp
+++ b/third_party/WebKit/Source/core/dom/Document.cpp
@@ -4226,21 +4226,9 @@ void Document::setCSSTarget(Element* newTarget) {
     m_cssTarget->pseudoStateChanged(CSSSelector::PseudoTarget);
 }
 
-static void liveNodeListBaseWriteBarrier(void* parent,
-                                         const LiveNodeListBase* list) {
-  if (isHTMLCollectionType(list->type())) {
-    ScriptWrappableVisitor::writeBarrier(
-        parent, static_cast<const HTMLCollection*>(list));
-  } else {
-    ScriptWrappableVisitor::writeBarrier(
-        parent, static_cast<const LiveNodeList*>(list));
-  }
-}
-
 void Document::registerNodeList(const LiveNodeListBase* list) {
   DCHECK(!m_nodeLists[list->invalidationType()].contains(list));
   m_nodeLists[list->invalidationType()].insert(list);
-  liveNodeListBaseWriteBarrier(this, list);
   if (list->isRootedAtTreeScope())
     m_listsInvalidatedAtDocument.insert(list);
 }
@@ -4257,7 +4245,6 @@ void Document::unregisterNodeList(const LiveNodeListBase* list) {
 void Document::registerNodeListWithIdNameCache(const LiveNodeListBase* list) {
   DCHECK(!m_nodeLists[InvalidateOnIdNameAttrChange].contains(list));
   m_nodeLists[InvalidateOnIdNameAttrChange].insert(list);
-  liveNodeListBaseWriteBarrier(this, list);
 }
 
 void Document::unregisterNodeListWithIdNameCache(const LiveNodeListBase* list) {
@@ -6585,17 +6572,6 @@ DEFINE_TRACE_WRAPPERS(Document) {
   visitor->traceWrappers(m_implementation);
   visitor->traceWrappers(m_styleSheetList);
   visitor->traceWrappers(m_styleEngine);
-  for (int i = 0; i < numNodeListInvalidationTypes; ++i) {
-    for (auto list : m_nodeLists[i]) {
-      if (isHTMLCollectionType(list->type())) {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const HTMLCollection*>(list.get()));
-      } else {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const LiveNodeList*>(list.get()));
-      }
-    }
-  }
   // Cannot trace in Supplementable<Document> as it is part of platform/ and
   // thus cannot refer to ScriptWrappableVisitor.
   visitor->traceWrappers(