Oilpan: fix debug crashes after r174545.

Source/bindings/v8/V8DOMWrapper.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 46 matching lines @@
     }
 
     v8::Local<v8::Function> shadowConstructor = shadowTemplate->GetFunction();
     if (shadowConstructor.IsEmpty())
         return v8::Local<v8::Object>();
 
     v8::Local<v8::Object> shadow = V8ScriptRunner::instantiateObject(isolate, shadowConstructor);
     if (shadow.IsEmpty())
         return v8::Local<v8::Object>();
     shadow->SetPrototype(wrapper);
+#if ENABLE(OILPAN)
+    V8DOMWrapper::setNativeInfoWithPersistentHandle(wrapper, &V8HTMLDocument::wrapperTypeInfo, impl, new Persistent<Node>(impl));

[haraken, 2014/05/22 12:55:04]

I'm not sure if this is right.

If you create a persistent handle here, you will end up creating two Persistent
handles for the Node. This will leak the Node, because the weak callback for the
Node wrapper will be called only once (because the |wrapper| is a hidden
prototype object). For more details, see the comment #5 in
https://codereview.chromium.org/211373002/

I guess a right fix here would be to call setNativeInfoForHiddenWrapper() here.
What happens if we use setNativeInfoForHiddenWrapper()? (Then I guess we don't
need the #if branch.)

sof@: You were working on handling hidden prototype chains of Window objects,
but do you have any idea on this?

[Mads Ager (chromium), 2014/05/22 13:12:28]

I have been the cause of confusion locally here. I mistakenly thought that the
setNativeInfo call was the one that was doing the ref increase. That is not
true. This is called from:

https://code.google.com/p/chromium/codesearch#chromium/src/out/Debug/gen/blin...

Therefore, Haraken is right that this should use the version that does not
allocate a persistent. The persistent will be allocated in the method above when
it calls associateObjectWithWrapper which will call
setNativeInfoWithPersistentHandle.

[sof, 2014/05/22 13:19:09]

Having a pair of Persistents on the same object does seem identical to the
DOMWindow case, with only one of them being cleared in the end. 

+#else
     V8DOMWrapper::setNativeInfo(wrapper, &V8HTMLDocument::wrapperTypeInfo, impl);
+#endif
     return shadow;
 }
 
 v8::Local<v8::Object> V8DOMWrapper::createWrapper(v8::Handle<v8::Object> creationContext, const WrapperTypeInfo* type, void* impl, v8::Isolate* isolate)
 {
     V8WrapperInstantiationScope scope(creationContext, isolate);
 
     V8PerContextData* perContextData = V8PerContextData::from(scope.context());
     v8::Local<v8::Object> wrapper = perContextData ? perContextData->createWrapperFromCache(type) : V8ObjectConstructor::newInstance(isolate, type->domTemplate(isolate)->GetFunction());
 
@@ skipping 15 matching lines @@
     ASSERT(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperObjectIndex));
     ASSERT(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
 
     const WrapperTypeInfo* typeInfo = static_cast<const WrapperTypeInfo*>(wrapper->GetAlignedPointerFromInternalField(v8DOMWrapperTypeIndex));
     // FIXME: We should add a more strict way to check if the typeInfo is a typeInfo of some DOM wrapper.
     // Even if it's a typeInfo of Blink, it's not guaranteed that it's a typeInfo of a DOM wrapper.
     return typeInfo->ginEmbedder == gin::kEmbedderBlink;
 }
 
 }  // namespace WebCore