Fix the problem that worker context object could be double deleted.

Review URL: http://codereview.chromium.org/28147

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@11013 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 10 insertions, 0 deletions

diff --git a/webkit/port/bindings/v8/WorkerContextExecutionProxy.cpp b/webkit/port/bindings/v8/WorkerContextExecutionProxy.cpp
index 02a6579..f4ab728 100644
--- a/webkit/port/bindings/v8/WorkerContextExecutionProxy.cpp
+++ b/webkit/port/bindings/v8/WorkerContextExecutionProxy.cpp
@@ -79,6 +79,16 @@ void WorkerContextExecutionProxy::Dispose() {
     m_context.Dispose();
     m_context.Clear();
   }
+
+  // Remove the wrapping between JS object and DOM object. This is because
+  // the worker context object is going to be disposed immediately when a
+  // worker thread is tearing down. We do not want to re-delete the real object
+  // when JS object is garbage collected.
+  v8::HandleScope scope;
+  v8::Persistent<v8::Object> wrapper = GetDOMObjectMap().get(m_workerContext);
+  if (!wrapper.IsEmpty())
+    V8Proxy::SetDOMWrapper(wrapper, V8ClassIndex::INVALID_CLASS_INDEX, NULL);
+  GetDOMObjectMap().forget(m_workerContext);
 }
 
 WorkerContextExecutionProxy* WorkerContextExecutionProxy::retrieve() {