[oilpan]: Don't assert the context is destroyed _after_ the NewWebSocketChannelImpl in oilpan.

Source/modules/websockets/NewWebSocketChannelImpl.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 131 matching lines @@
     virtual void didReceiveData(blink::WebSocketHandle*, bool fin, blink::WebSocketHandle::MessageType, const char* data, size_t /* size */) OVERRIDE;
     virtual void didClose(blink::WebSocketHandle*, bool wasClean, unsigned short code, const blink::WebString& reason) OVERRIDE;
     virtual void didReceiveFlowControl(blink::WebSocketHandle*, int64_t quota) OVERRIDE;
     virtual void didStartClosingHandshake(blink::WebSocketHandle*) OVERRIDE;
 
     // Methods for BlobLoader.
     void didFinishLoadingBlob(PassRefPtr<ArrayBuffer>);
     void didFailLoadingBlob(FileError::ErrorCode);
 
     // LifecycleObserver functions.
     // This object must be destroyed before the context.

[sof, 2014/07/17 13:39:30]

surface nit: move this comment down into the #else part?

[wibling-chromium, 2014/07/17 14:16:49]

Done.

-    virtual void contextDestroyed() OVERRIDE { ASSERT_NOT_REACHED(); }
+    virtual void contextDestroyed() OVERRIDE
+    {
+#if ENABLE(OILPAN)
+        // In oilpan we cannot assume this channel's finalizer has been called
+        // before the document it is observing is dead and finalized since there
+        // is no eager finalization. Instead the finalization happens at the
+        // next GC which could be long enough after the Peer::destroy call for
+        // the context (ie. Document) to be dead too. If the context's finalizer
+        // is run first this method gets called. Instead we assert the channel
+        // has been disconnected which happens in Peer::destroy.
+        ASSERT(!m_handle);
+        ASSERT(!m_client);
+        ASSERT(!m_identifier);
+#else
+        ASSERT_NOT_REACHED();
+#endif
+    }
 
     // m_handle is a handle of the connection.
     // m_handle == 0 means this channel is closed.
     OwnPtr<blink::WebSocketHandle> m_handle;
 
     // m_client can be deleted while this channel is alive, but this class
     // expects that disconnect() is called before the deletion.
     RawPtrWillBeMember<WebSocketChannelClient> m_client;
     KURL m_url;
     // m_identifier > 0 means calling scriptContextExecution() returns a Document.
@@ skipping 10 matching lines @@
     String m_sourceURLAtConstruction;
     unsigned m_lineNumberAtConstruction;
     RefPtr<WebSocketHandshakeRequest> m_handshakeRequest;
 
     static const int64_t receivedDataSizeForFlowControlHighWaterMark = 1 << 15;
 };
 
 } // namespace WebCore
 
 #endif // NewWebSocketChannelImpl_h