Oilpan: dispose ServiceWorker (and registration) objects earlier.

Source/modules/serviceworkers/ServiceWorker.cpp

Index: Source/modules/serviceworkers/ServiceWorker.cpp
diff --git a/Source/modules/serviceworkers/ServiceWorker.cpp b/Source/modules/serviceworkers/ServiceWorker.cpp
index 2c746c86e95806abdc2ee3f7cfc4caa2224232aa..580ac997769ec4711969cc83efd5619e097b8e76 100644
--- a/Source/modules/serviceworkers/ServiceWorker.cpp
+++ b/Source/modules/serviceworkers/ServiceWorker.cpp
@@ -260,8 +260,28 @@ ServiceWorker::ServiceWorker(ExecutionContext* executionContext, PassOwnPtr<WebS
     , m_outerWorker(worker)
     , m_proxyState(Initial)
 {
+    WILL_REGISTER_PREFINALIZER(this);
     ASSERT(m_outerWorker);
     m_outerWorker->setProxy(this);
 }
 
+ServiceWorker::~ServiceWorker()
+{

[haraken, 2015/01/26 01:39:42]

Can we add ASSERT(!m_outerWorker)?

[sof, 2015/01/26 06:32:46]

Non-Oilpan you clearly could.

+}
+
+void ServiceWorker::dispose()
+{
+    // With Oilpan enabled, the observable lifetime of a ServiceWorker
+    // must not extend beyond when it has been deemed to be unreachable
+    // by the garbage collector. The embedder must be detached before
+    // it is eventually (lazily) swept, so as to prevent that. Otherwise
+    // the embedder might risk accessing a to-be-finalized object that
+    // is not in a valid state.
+    //
+    // The dispose() method is hooked up to the garbage collector by
+    // way of a "pre finalizer", a method that is run after marking
+    // has completed, but before any sweeping takes place.
+    m_outerWorker.clear();
+}
+
 } // namespace blink