Oilpan: disable conservative GCs during initial GC mixin construction.

Source/platform/heap/ThreadState.h

Index: Source/platform/heap/ThreadState.h
diff --git a/Source/platform/heap/ThreadState.h b/Source/platform/heap/ThreadState.h
index 3679356d36122a6d2663f34d95b126db10e55d0e..36a8bfcf8778cd68028d9b802b1789467675b611 100644
--- a/Source/platform/heap/ThreadState.h
+++ b/Source/platform/heap/ThreadState.h
@@ -582,6 +582,17 @@ public:
 
     double collectionRate() const { return m_collectionRate; }
 
+    // By entering a gc-forbidden scope, conservative GCs will not
+    // be allowed while handling an out-of-line allocation request.
+    // Intended used when constructing subclasses of GC mixins, where
+    // the object being constructed cannot be safely traced & marked
+    // fully should a GC be allowed while its subclasses are being
+    // constructed.
+    void enterGCForbiddenScope()
+    {
+        m_gcForbiddenCount++;
+    }
+
 private:
     ThreadState();
     ~ThreadState();
@@ -626,18 +637,18 @@ private:
     void snapshotFreeList();
 #endif
 
-    // By entering a gc-forbidden scope, conservative GCs will not
-    // be allowed while handling an out-of-line allocation request.
-    // Intended used when constructing subclasses of GC mixins, where
-    // the object being constructed cannot be safely traced & marked
-    // fully should a GC be allowed while its subclasses are being
-    // constructed.
-    template<typename U, typename V> friend class AllocateObjectTrait;
-    void enterGCForbiddenScope() { m_gcForbiddenCount++; }
+    template<typename U> friend class GarbageCollectedMixinConstructorMarker;
     void leaveGCForbiddenScope()
     {
-        ASSERT(m_gcForbiddenCount > 0);
-        m_gcForbiddenCount--;
+        // FIXME: if a declared mixin object derives from another,
+        // its instantiation will leave this scope twice, which
+        // will lead to unbalanced accounting. If that happens
+        // nestedly as part of constructing another mixin, this
+        // might result in the forbidden GC scope being exited
+        // too early. Theoretically; no Blink mixin objects
+        // known to have such nested constructors and be at risk.
+        if (m_gcForbiddenCount)

[haraken, 2015/03/05 02:20:19]

Hmm, it is concerning that m_gcForbiddenCount can be unbalanced. It would be
safe as far as we decrease m_gcForbiddenCount too much, but it is dangerous if
we increase m_gcForbiddenCount too much because it will end up with suppressing
GCs for a long time. I don't think this will happen with this CL, but the fact
that the counter is not balanced looks not nice...

+            m_gcForbiddenCount--;
     }
 
     static WTF::ThreadSpecific<ThreadState*>* s_threadSpecific;