Add a pre-finalizer to PromiseRejectionEvent

We need to clear ScopedPersistents so that V8 doesn't call phantom callbacks
after Oilpan starts lazy sweeping.

BUG=626893

Review-Url: https://codereview.chromium.org/2196543003
Cr-Commit-Position: refs/heads/master@{#408742}

third_party/WebKit/Source/core/events/PromiseRejectionEvent.cpp

@@ -17,6 +17,7 @@ PromiseRejectionEvent::PromiseRejectionEvent(ScriptState* state, const AtomicStr
     : Event(type, initializer)
     , m_scriptState(state)
 {
+    ThreadState::current()->registerPreFinalizer(this);
     ASSERT(initializer.hasPromise());
     m_promise.set(initializer.promise().isolate(), initializer.promise().v8Value());
     m_promise.setPhantom();
@@ -30,6 +31,15 @@ PromiseRejectionEvent::~PromiseRejectionEvent()
 {
 }
 
+void PromiseRejectionEvent::dispose()
+{
+    // Clear ScopedPersistents so that V8 doesn't call phantom callbacks
+    // (and touch the ScopedPersistents) after Oilpan starts lazy sweeping.
+    m_promise.clear();
+    m_reason.clear();
+    m_scriptState.clear();
+}
+
 ScriptPromise PromiseRejectionEvent::promise(ScriptState* state) const
 {
     // Return null when the promise is accessed by a different world than the world that created the promise.

third_party/WebKit/Source/core/events/PromiseRejectionEvent.h

@@ -18,6 +18,7 @@ namespace blink {
 
 class CORE_EXPORT PromiseRejectionEvent final : public Event {
     DEFINE_WRAPPERTYPEINFO();
+    USING_PRE_FINALIZER(PromiseRejectionEvent, dispose);
 public:
     static PromiseRejectionEvent* create()
     {
@@ -47,6 +48,7 @@ private:
     PromiseRejectionEvent();
     PromiseRejectionEvent(ScriptState*, const AtomicString&, const PromiseRejectionEventInit&);
     ~PromiseRejectionEvent() override;
+    void dispose();
 
     RefPtr<ScriptState> m_scriptState;
     ScopedPersistent<v8::Value> m_promise;