[svg] TearOffs dynamically hold on to the current contextElement().

Source/bindings/v8/V8GCController.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 29 matching lines @@
 #include "bindings/v8/V8AbstractEventListener.h"
 #include "bindings/v8/V8Binding.h"
 #include "bindings/v8/WrapperTypeInfo.h"
 #include "core/dom/Attr.h"
 #include "core/dom/NodeTraversal.h"
 #include "core/dom/TemplateContentDocumentFragment.h"
 #include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLImageElement.h"
 #include "core/html/HTMLTemplateElement.h"
+#include "core/svg/SVGElement.h"
 #include "platform/TraceEvent.h"
 
 namespace WebCore {
 
 // FIXME: This should use opaque GC roots.
 static void addReferencesForNodeWithEventListeners(v8::Isolate* isolate, Node* node, const v8::Persistent<v8::Object>& wrapper)
 {
     ASSERT(node->hasEventListeners());
 
     EventListenerIterator iterator(node);
@@ skipping 93 matching lines @@
 
 private:
     bool traverseTree(Node* rootNode, Vector<Node*, initialNodeVectorSize>* newSpaceNodes)
     {
         // To make each minor GC time bounded, we might need to give up
         // traversing at some point for a large DOM tree. That being said,
         // I could not observe the need even in pathological test cases.
         for (Node* node = rootNode; node; node = NodeTraversal::next(*node)) {
             if (node->containsWrapper()) {
                 // FIXME: Remove the special handling for image elements.
+                // FIXME: Remove the special handling for SVG context elements.
                 // The same special handling is in V8GCController::opaqueRootForGC().
                 // Maybe should image elements be active DOM nodes?
                 // See https://code.google.com/p/chromium/issues/detail?id=164882
-                if (!node->isV8CollectableDuringMinorGC() || (node->hasTagName(HTMLNames::imgTag) && toHTMLImageElement(node)->hasPendingActivity())) {
+                if (!node->isV8CollectableDuringMinorGC() || (node->hasTagName(HTMLNames::imgTag) && toHTMLImageElement(node)->hasPendingActivity()) || (node->isSVGElement() && toSVGElement(node)->isContextElement())) {
                     // This node is not in the new space of V8. This indicates that
                     // the minor GC cannot anyway judge reachability of this DOM tree.
                     // Thus we give up traversing the DOM tree.
                     return false;
                 }
                 node->setV8CollectableDuringMinorGC(false);
                 newSpaceNodes->append(node);
             }
             if (ShadowRoot* shadowRoot = node->youngestShadowRoot()) {
                 if (!traverseTree(shadowRoot, newSpaceNodes))
@@ skipping 245 matching lines @@
 {
     v8::HandleScope handleScope(isolate);
     v8::Local<v8::Context> context = v8::Context::New(isolate);
     if (context.IsEmpty())
         return;
     v8::Context::Scope contextScope(context);
     V8ScriptRunner::compileAndRunInternalScript(v8String("if (gc) gc();", isolate), isolate);
 }
 
 }  // namespace WebCore