Oilpan: fix debug crashes after r174545.

Source/bindings/v8/V8DOMWrapper.cpp

Index: Source/bindings/v8/V8DOMWrapper.cpp
diff --git a/Source/bindings/v8/V8DOMWrapper.cpp b/Source/bindings/v8/V8DOMWrapper.cpp
index 7efe6372bd188ba9e019f4e8b3055345d13e75eb..89005dfb2c41bdc98fa691015ae63c804622e7d2 100644
--- a/Source/bindings/v8/V8DOMWrapper.cpp
+++ b/Source/bindings/v8/V8DOMWrapper.cpp
@@ -64,7 +64,11 @@ static v8::Local<v8::Object> wrapInShadowTemplate(v8::Local<v8::Object> wrapper,
     if (shadow.IsEmpty())
         return v8::Local<v8::Object>();
     shadow->SetPrototype(wrapper);
+#if ENABLE(OILPAN)
+    V8DOMWrapper::setNativeInfoWithPersistentHandle(wrapper, &V8HTMLDocument::wrapperTypeInfo, impl, new Persistent<Node>(impl));

[haraken, 2014/05/22 12:55:04]

I'm not sure if this is right.

If you create a persistent handle here, you will end up creating two Persistent
handles for the Node. This will leak the Node, because the weak callback for the
Node wrapper will be called only once (because the |wrapper| is a hidden
prototype object). For more details, see the comment #5 in
https://codereview.chromium.org/211373002/

I guess a right fix here would be to call setNativeInfoForHiddenWrapper() here.
What happens if we use setNativeInfoForHiddenWrapper()? (Then I guess we don't
need the #if branch.)

sof@: You were working on handling hidden prototype chains of Window objects,
but do you have any idea on this?

[Mads Ager (chromium), 2014/05/22 13:12:28]

I have been the cause of confusion locally here. I mistakenly thought that the
setNativeInfo call was the one that was doing the ref increase. That is not
true. This is called from:

https://code.google.com/p/chromium/codesearch#chromium/src/out/Debug/gen/blin...

Therefore, Haraken is right that this should use the version that does not
allocate a persistent. The persistent will be allocated in the method above when
it calls associateObjectWithWrapper which will call
setNativeInfoWithPersistentHandle.

[sof, 2014/05/22 13:19:09]

Having a pair of Persistents on the same object does seem identical to the
DOMWindow case, with only one of them being cleared in the end. 

+#else
     V8DOMWrapper::setNativeInfo(wrapper, &V8HTMLDocument::wrapperTypeInfo, impl);
+#endif
     return shadow;
 }