[wrapper-tracing] Fix node list leak

third_party/WebKit/Source/core/dom/Document.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2011, 2012 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008, 2009, 2011, 2012 Google Inc. All rights reserved.
@@ skipping 6608 matching lines @@
   DCHECK(frame()->isCrossOriginSubframe());
   if (reason <= m_wouldLoadReason ||
       !frame()->loader().stateMachine()->committedFirstRealDocumentLoad())
     return;
   for (int i = m_wouldLoadReason + 1; i <= reason; ++i)
     recordLoadReasonToHistogram(static_cast<WouldLoadReason>(i));
   m_wouldLoadReason = reason;
 }
 
 DEFINE_TRACE_WRAPPERS(Document) {
+  // m_nodeLists are traced in their corresponding NodeListsNodeData, keeping
+  // them only alive for live nodes. Otherwise we would keep lists of dead
+  // nodes alive that have not yet been invalidated.
   visitor->traceWrappers(m_importsController);
   visitor->traceWrappers(m_implementation);
   visitor->traceWrappers(m_styleSheetList);
   visitor->traceWrappers(m_styleEngine);
-  for (int i = 0; i < numNodeListInvalidationTypes; ++i) {
-    for (auto list : m_nodeLists[i]) {
-      if (isHTMLCollectionType(list->type())) {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const HTMLCollection*>(list.get()));
-      } else {
-        visitor->traceWrappersWithManualWriteBarrier(
-            static_cast<const LiveNodeList*>(list.get()));
-      }
-    }
-  }
   // Cannot trace in Supplementable<Document> as it is part of platform/ and
   // thus cannot refer to ScriptWrappableVisitor.
   visitor->traceWrappers(
       static_cast<FontFaceSet*>(Supplementable<Document>::m_supplements.at(
           FontFaceSet::supplementName())));
   ContainerNode::traceWrappers(visitor);
 }
 
 template class CORE_TEMPLATE_EXPORT Supplement<Document>;
 
 }  // namespace blink
 
 #ifndef NDEBUG
 static WeakDocumentSet& liveDocumentSet() {
   DEFINE_STATIC_LOCAL(WeakDocumentSet, set, ());
   return set;
 }
 
 void showLiveDocumentInstances() {
   WeakDocumentSet& set = liveDocumentSet();
   fprintf(stderr, "There are %u documents currently alive:\n", set.size());
   for (blink::Document* document : set)
     fprintf(stderr, "- Document %p URL: %s\n", document,
             document->url().getString().utf8().data());
 }
 #endif