Fix for issue 81

Putting all peers of DOM nodes in an object group, so they won't be garbage
collected too soon.
Review URL: http://codereview.chromium.org/7228

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@3341 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 13 insertions, 4 deletions

diff --git a/webkit/port/bindings/v8/v8_proxy.cpp b/webkit/port/bindings/v8/v8_proxy.cpp
index 76b475b..d6055ea 100644
--- a/webkit/port/bindings/v8/v8_proxy.cpp
+++ b/webkit/port/bindings/v8/v8_proxy.cpp
@@ -457,14 +457,23 @@ static void GCPrologue()
     // it is not in a document. However, if the load event has not
     // been fired (still onloading), it is treated as in the document.
     //
+    // Otherwise, the node is put in an object group identified by the root
+    // elment of the tree to which it belongs.
+    void* group_id;
     if (node->inDocument() ||
         (node->hasTagName(HTMLNames::imgTag) &&
          !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent()) ) {
-      Document* doc = node->document();
-      v8::Persistent<v8::Object> wrapper = dom_node_map().get(node);
-      if (!wrapper.IsEmpty())
-        v8::V8::AddObjectToGroup(doc, wrapper);
+      group_id = node->document();
+    } else {
+      Node* root = node;
+      while (root->parent()) {
+        root = root->parent();
+      }
+      group_id = root;
     }
+    v8::Persistent<v8::Object> wrapper = dom_node_map().get(node);
+    if (!wrapper.IsEmpty())
+      v8::V8::AddObjectToGroup(group_id, wrapper);
   }
 }