v8binding: Makes WindowProxy::global_proxy_ a weak reference when detached.

Once the context's frame is detached from the DOM, we shouldn't hold
a strong reference to v8::Context.  This CL makes WindowProxy::global_proxy_
a weak reference once the frame is detached.

This CL is a preparation of https://crrev.com/2713623002 .

BUG=

Review-Url: https://codereview.chromium.org/2811943003
Cr-Commit-Position: refs/heads/master@{#464304}

third_party/WebKit/Source/bindings/core/v8/LocalWindowProxy.cpp

@@ -106,6 +106,12 @@ void LocalWindowProxy::DisposeContext(Lifecycle next_status) {
   V8GCForContextDispose::Instance().NotifyContextDisposed(
       GetFrame()->IsMainFrame());
 
+  if (next_status == Lifecycle::kFrameIsDetached) {
+    // The context's frame is detached from the DOM, so there shouldn't be a
+    // strong reference to the context.
+    global_proxy_.SetPhantom();
+  }
+
   DCHECK_EQ(lifecycle_, Lifecycle::kContextIsInitialized);
   lifecycle_ = next_status;
 }

third_party/WebKit/Source/bindings/core/v8/RemoteWindowProxy.cpp

@@ -66,6 +66,12 @@ void RemoteWindowProxy::DisposeContext(Lifecycle next_status) {
 #endif
   }
 
+  if (next_status == Lifecycle::kFrameIsDetached) {
+    // The context's frame is detached from the DOM, so there shouldn't be a
+    // strong reference to the context.
+    global_proxy_.SetPhantom();
+  }
+
   DCHECK_EQ(lifecycle_, Lifecycle::kContextIsInitialized);
   lifecycle_ = next_status;
 }

third_party/WebKit/Source/bindings/core/v8/WindowProxy.h

@@ -206,7 +206,9 @@ class WindowProxy : public GarbageCollectedFinalized<WindowProxy> {
   // to the context and hence author script may run in the context.
   // The spec does not support some of web features such as setTimeout, etc. on
   // a detached window. Blink supports less things than the spec.
-  // V8PerContextData is cut off from the context.
+  // V8PerContextData is cut off from the context.  |global_proxy_| becomes a
+  // weak reference so that it's collectable when author script has no
+  // reference.
   // - Possible next states: n/a
   enum class Lifecycle {
     // v8::Context is not yet initialized.
@@ -249,6 +251,10 @@ class WindowProxy : public GarbageCollectedFinalized<WindowProxy> {
  protected:
   // TODO(dcheng): Consider making these private and using getters.
   const RefPtr<DOMWrapperWorld> world_;
+  // |global_proxy_| is the root reference from Blink to v8::Context (a strong
+  // reference to the global proxy makes the entire context alive).  In order to
+  // discard the v8::Context, |global_proxy_| needs to be a weak reference or
+  // to be destroyed.
   ScopedPersistent<v8::Object> global_proxy_;
   Lifecycle lifecycle_;
 };