Oilpan: DOM wrappers don't need to keep persistent handles

Source/bindings/core/v8/V8GCController.cpp

Index: Source/bindings/core/v8/V8GCController.cpp
diff --git a/Source/bindings/core/v8/V8GCController.cpp b/Source/bindings/core/v8/V8GCController.cpp
index f237c7be997ed301c073703c341ea33f0f38f3d3..ed86ebe59960b0c65cdfbef61c9bc76066d24a0f 100644
--- a/Source/bindings/core/v8/V8GCController.cpp
+++ b/Source/bindings/core/v8/V8GCController.cpp
@@ -456,4 +456,34 @@ void V8GCController::reportDOMMemoryUsageToV8(v8::Isolate* isolate)
     lastUsageReportedToV8 = currentUsage;
 }
 
+class DOMWrapperTracer : public v8::PersistentHandleVisitor {
+public:
+    explicit DOMWrapperTracer(Visitor* visitor)
+        : m_visitor(visitor)
+    {
+    }
+
+    virtual void VisitPersistentHandle(v8::Persistent<v8::Value>* value, uint16_t classId) override
+    {
+        if (classId != WrapperTypeInfo::NodeClassId && classId != WrapperTypeInfo::ObjectClassId)
+            return;
+
+        // Casting to a Handle is safe here, since the Persistent doesn't get GCd
+        // during tracing.
+        ASSERT((*reinterpret_cast<v8::Handle<v8::Value>*>(value))->IsObject());
+        v8::Handle<v8::Object>* wrapper = reinterpret_cast<v8::Handle<v8::Object>*>(value);
+        ASSERT(V8DOMWrapper::isDOMWrapper(*wrapper));
+        toWrapperTypeInfo(*wrapper)->trace(m_visitor, toScriptWrappableBase(*wrapper));
+    }
+
+private:
+    Visitor* m_visitor;
+};
+
+void V8GCController::traceDOMWrappers(Visitor* visitor)
+{
+    DOMWrapperTracer tracer(visitor);
+    v8::V8::VisitHandlesWithClassIds(&tracer);

[haraken, 2014/10/15 10:43:04]

This is problematic... When doing an Oilpan's GC, a GCing thread invokes
traceDOMWrappers for each ThreadState. Each traceDOMWrappers is expected to
visit DOM wrappers of each thread, but it doesn't happen because
VisitHandlesWithClassIds visits DOM wrappers of the current isolate (i.e., the
current thread).

As a result, V8GCController::traceDOMWrappers just visits DOM wrappers in the
GCing thread and doesn't trace DOM wrappers in other threads.

+}
+
 } // namespace blink