Do not fire timers for finalizing objects.

Source/platform/heap/Heap.cpp

Index: Source/platform/heap/Heap.cpp
diff --git a/Source/platform/heap/Heap.cpp b/Source/platform/heap/Heap.cpp
index 24a4bf4d569c3309a189aae0e849d71157e9ad1b..dfc57797e39e465ba2ae787a45ec8fe32af530cc 100644
--- a/Source/platform/heap/Heap.cpp
+++ b/Source/platform/heap/Heap.cpp
@@ -543,6 +543,7 @@ void LargeObject::markUnmarkedObjectsDead()
 
 void LargeObject::removeFromHeap(ThreadHeap* heap)
 {
+    m_sweepStatus = 0;
     heap->freeLargeObject(this);
 }
 
@@ -747,11 +748,11 @@ Address ThreadHeap::lazySweepPages(size_t allocationSize, size_t gcInfoIndex)
             page->sweep(this);
             page->unlink(&m_firstUnsweptPage);
             page->link(&m_firstPage);
+            page->markAsLazilySwept();
 
             result = allocateFromFreeList(allocationSize, gcInfoIndex);
-            if (result) {
+            if (result)
                 break;
-            }
         }
     }
 
@@ -804,6 +805,7 @@ bool ThreadHeap::lazySweepLargeObjects(size_t allocationSize)
             largeObject->sweep(this);
             largeObject->unlink(&m_firstUnsweptLargeObject);
             largeObject->link(&m_firstLargeObject);
+            largeObject->markAsLazilySwept();
         }
     }
 
@@ -832,6 +834,7 @@ void ThreadHeap::completeSweep()
             page->sweep(this);
             page->unlink(&m_firstUnsweptPage);
             page->link(&m_firstPage);
+            page->markAsLazilySwept();
         }
     }
 
@@ -847,6 +850,7 @@ void ThreadHeap::completeSweep()
             largeObject->sweep(this);
             largeObject->unlink(&m_firstUnsweptLargeObject);
             largeObject->link(&m_firstLargeObject);
+            largeObject->markAsLazilySwept();
         }
     }
 
@@ -1238,6 +1242,28 @@ BaseHeapPage::BaseHeapPage(PageMemory* storage, ThreadState* state)
     ASSERT(isPageHeaderAddress(reinterpret_cast<Address>(this)));
 }
 
+void BaseHeapPage::markAsLazilySwept()
+{
+    // To signal completion of a lazy sweep, update the
+    // page's sweep status to match that of the ThreadState's
+    // flip-flop sweep token.
+    bool currentToken = threadState()->lazySweepToken();
+    m_sweepStatus = currentToken ? 2 : 1;
+}
+
+bool BaseHeapPage::hasBeenLazilySwept() const
+{
+    // Returns true if this page has been swept
+    // by the ongoing lazy sweep operation.
+    ASSERT(threadState()->isSweepingInProgress());
+    ASSERT(m_sweepStatus <= 2);
+    if (!m_sweepStatus)
+        return false;
+
+    bool currentToken = threadState()->lazySweepToken();
+    return currentToken == (m_sweepStatus == 2);
+}
+
 void BaseHeapPage::markOrphaned()
 {
     m_threadState = nullptr;
@@ -1618,6 +1644,7 @@ void HeapPage::markUnmarkedObjectsDead()
 
 void HeapPage::removeFromHeap(ThreadHeap* heap)
 {
+    m_sweepStatus = 0;
     heap->freePage(this);
 }
 
@@ -2126,6 +2153,24 @@ Address Heap::checkAndMarkPointer(Visitor* visitor, Address address)
     return nullptr;
 }
 
+bool Heap::isFinalizedObjectAlive(const void* objectPointer)

[haraken, 2015/01/16 00:57:10]

I like having this method in our heap infrastructure -- it would be useful to
catch various errors. For example, we can add
ASSERT(!isFinalizedObjectAlive(m_raw)) to Member::operator-> to detect code that
is accessing on-heap objects in destructors etc.

+{
+#if ENABLE(OILPAN)
+    if (!ThreadState::current()->isSweepingInProgress())
+        return true;
+
+    BaseHeapPage* page = pageFromObject(objectPointer);
+    if (page->hasBeenLazilySwept())
+        return true;
+
+    return s_markingVisitor->isMarked(objectPointer);
+#else
+    // FIXME: remove when incremental sweeping is always on
+    // (cf. ThreadState::postGCProcessing()).
+    return true;
+#endif
+}
+
 #if ENABLE(GC_PROFILE_MARKING)
 const GCInfo* Heap::findGCInfo(Address address)
 {