Simplify and weaken DOMWindowProperty unregistration

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 0dfa1b05271b5c9587a68c34c68a3249409bfed4..29b116fc61f9a0c629ad98e771a12e1a6e1afa70 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -556,22 +556,14 @@ void LocalDOMWindow::willDetachFrameHost()
 
 void LocalDOMWindow::willDestroyDocumentInFrame()
 {
-    // It is necessary to copy m_properties to a separate vector because the DOMWindowProperties may
-    // unregister themselves from the LocalDOMWindow as a result of the call to willDestroyGlobalObjectInFrame.
-    WillBeHeapVector<RawPtrWillBeMember<DOMWindowProperty> > properties;

[Mads Ager (chromium), 2014/09/15 07:58:21]

Do you still need the copy for the non-oilpan case? In the oilpan build you
don't because we strongify weak collections with pointers to them on the stack.
What prevents modification during iteration in the non-oilpan build? Has
something changed that ensures that the willDestroyGlobalObjectInFrame call
cannot lead to the death of a DOMWindowProperty which will then unregister
itself which will be a modification during iteration?

[sof, 2014/09/15 08:10:25]

No implementation of willDestroyGlobalObjectInFrame() unregisters nor deletes
itself, and DOMWindowProperty::willDestroyGlobalObjectInFrame() clears out the
back reference. This seems like a reasonably easy invariant to maintain "going
forward".

[Mads Ager (chromium), 2014/09/15 08:11:40]

Sounds good. Thanks for double checking and explaining. :)

-    copyToVector(m_properties, properties);
-    for (size_t i = 0; i < properties.size(); ++i)
-        properties[i]->willDestroyGlobalObjectInFrame();
+    for (WillBeHeapHashSet<RawPtrWillBeWeakMember<DOMWindowProperty> >::const_iterator it = m_properties.begin(); it != m_properties.end(); ++it)
+        (*it)->willDestroyGlobalObjectInFrame();
 }
 
 void LocalDOMWindow::willDetachDocumentFromFrame()
 {
-    // It is necessary to copy m_properties to a separate vector because the DOMWindowProperties may
-    // unregister themselves from the LocalDOMWindow as a result of the call to willDetachGlobalObjectFromFrame.
-    WillBeHeapVector<RawPtrWillBeMember<DOMWindowProperty> > properties;

[Mads Ager (chromium), 2014/09/15 07:58:21]

Ditto.

-    copyToVector(m_properties, properties);
-    for (size_t i = 0; i < properties.size(); ++i)
-        properties[i]->willDetachGlobalObjectFromFrame();
+    for (WillBeHeapHashSet<RawPtrWillBeWeakMember<DOMWindowProperty> >::const_iterator it = m_properties.begin(); it != m_properties.end(); ++it)
+        (*it)->willDetachGlobalObjectFromFrame();
 }
 
 void LocalDOMWindow::registerProperty(DOMWindowProperty* property)