Oilpan: handle delayed removal of PromiseTracker promises.

Source/core/inspector/PromiseTracker.cpp

Index: Source/core/inspector/PromiseTracker.cpp
diff --git a/Source/core/inspector/PromiseTracker.cpp b/Source/core/inspector/PromiseTracker.cpp
index b7d9a1f7feffcdd7a703a5ac282b90665f7a4160..546eeb938b0537777667cf3322f19dce54ee0071 100644
--- a/Source/core/inspector/PromiseTracker.cpp
+++ b/Source/core/inspector/PromiseTracker.cpp
@@ -27,7 +27,13 @@ public:
     int promiseHash() const { return m_promiseHash; }
     ScopedPersistent<v8::Object>& promise() { return m_promise; }
 
-#if !ENABLE(OILPAN)
+#if ENABLE(OILPAN)
+    void dispose()
+    {
+        m_promise.clear();
+        m_parentPromise.clear();
+    }
+#else
     WeakPtr<PromiseData> createWeakPtr()
     {
         return m_weakPtrFactory.createWeakPtr();
@@ -103,7 +109,16 @@ public:
         WeakPtrWillBeRawPtr<PromiseTracker::PromiseData> promiseData = wrapper->m_data;
         if (!promiseData || !wrapper->m_tracker)
             return;
+
+#if ENABLE(OILPAN)
+        // Oilpan: let go of ScopedPersistent<>s right here (and not wait until the
+        // PromiseDataWrapper is GCed later.) The v8 weak callback handling expects
+        // to see the callback data upon return.
+        promiseData->dispose();
+#endif
         PromiseTracker::PromiseDataMap& map = wrapper->m_tracker->promiseDataMap();
+        if (map.isEmpty())
+            return;

[aandrey, 2014/09/15 12:38:44]

let's bail out if (map.find() == map.end()) instead

[sof, 2014/09/15 12:40:30]

That would mask a bug -- all promise hashes should have a mapping here..or the
table should be empty.

[aandrey, 2014/09/15 12:46:04]

The PromiseTracker could be disabled and re-enabled again. AFAIU, this won't
necessarily prevent a weak callback from an old promise to execute up to this
point in Oilpan build. If my understanding is correct, the
"map.find(promiseHash)->value" will crash.

         int promiseHash = promiseData->promiseHash();
         PromiseTracker::PromiseDataVector* vector = &map.find(promiseHash)->value;
         int index = indexOf(vector, promiseData->promise());