v8binding: Makes WindowProxy::global_proxy_ a weak reference when detached.

third_party/WebKit/Source/bindings/core/v8/WindowProxy.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 188 matching lines @@
   // completed, the WindowProxy will always be reinitialized, as
   // |DocumentLoader::InstallNewDocument| ends up calling to
   // |WindowProxy::UpdateDocument|, which reinitializes the WindowProxy.
   //
   // * kFrameIsDetached
   // The context was initialized, but its frame has been detached from the DOM.
   // Note that the context is still alive and author script may have references
   // to the context and hence author script may run in the context.
   // The spec does not support some of web features such as setTimeout, etc. on
   // a detached window. Blink supports less things than the spec.
-  // V8PerContextData is cut off from the context.
+  // V8PerContextData is cut off from the context.  |global_proxy_| becomes a
+  // weak reference so that it's collectable when author script has no
+  // reference.
   // - Possible next states: n/a
   enum class Lifecycle {
     // v8::Context is not yet initialized.
     kContextIsUninitialized,
     // v8::Context is initialized.
     kContextIsInitialized,
     // The global object (inner global) is detached from the global proxy (outer
     // global).
     kGlobalObjectIsDetached,
     // The context's frame is detached from the DOM.
@@ skipping 22 matching lines @@
  private:
   v8::Isolate* const isolate_;
   const Member<Frame> frame_;
 #if DCHECK_IS_ON()
   bool is_global_object_attached_ = false;
 #endif
 
  protected:
   // TODO(dcheng): Consider making these private and using getters.
   const RefPtr<DOMWrapperWorld> world_;
+  // |global_proxy_| is the root reference from Blink to v8::Context (a strong
+  // reference to the global proxy makes the entire context alive).  In order to
+  // discard the v8::Context, |global_proxy_| needs to be a weak reference or
+  // to be destroyed.

[haraken, 2017/04/11 14:32:54]

// |global_proxy_| needs to be made a weak reference when the frame gets
detached
 

   ScopedPersistent<v8::Object> global_proxy_;
   Lifecycle lifecycle_;
 };
 
 }  // namespace blink
 
 #endif  // WindowProxy_h