Oilpan: dispose ServiceWorker (and registration) objects earlier.

Source/modules/serviceworkers/ServiceWorker.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 242 matching lines @@
     RefPtrWillBeRawPtr<ServiceWorker> worker = adoptRefWillBeNoop(new ServiceWorker(executionContext, adoptPtr(outerWorker)));
     worker->suspendIfNeeded();
     return worker.release();
 }
 
 ServiceWorker::ServiceWorker(ExecutionContext* executionContext, PassOwnPtr<WebServiceWorker> worker)
     : AbstractWorker(executionContext)
     , m_outerWorker(worker)
     , m_proxyState(Initial)
 {
+#if ENABLE(OILPAN)
+    ThreadState::current()->registerPreFinalizer(*this);
+#endif
     ASSERT(m_outerWorker);
     m_outerWorker->setProxy(this);
 }
 
+ServiceWorker::~ServiceWorker()
+{
+#if ENABLE(OILPAN)
+    ASSERT(!m_outerWorker);
+#endif
+}
+
+void ServiceWorker::dispose()
+{
+    // With Oilpan enabled, the observable lifetime of a ServiceWorker
+    // must not extend beyond when it has been deemed to be unreachable
+    // by the garbage collector. The embedder must be detached before
+    // it is eventually (lazily) swept, so as to prevent that. Otherwise
+    // the embedder might risk accessing a to-be-finalized object that
+    // is not in a valid state.
+    //
+    // The dispose() method is hooked up to the garbage collector by
+    // way of a "pre finalizer", a method that is run after marking
+    // has completed, but before any sweeping takes place.
+    m_outerWorker.clear();
+}
+
 } // namespace blink