[wrapper-tracing] MutationObserver: Add write barriers

Overview: https://docs.google.com/spreadsheets/d/1RhLiHF9Pnw7Zx8EijuR0LruPkeiVJIXXi0eRkRDFwBc/edit#gid=0&vpid=A3

BUG=chromium:468240
R=haraken@chromium.org

Review-Url: https://codereview.chromium.org/2396693004
Cr-Commit-Position: refs/heads/master@{#423820}

third_party/WebKit/Source/core/dom/Node.cpp

@@ -29,6 +29,7 @@
 #include "bindings/core/v8/DOMDataStore.h"
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/Microtask.h"
+#include "bindings/core/v8/ScriptWrappableVisitor.h"
 #include "bindings/core/v8/V8DOMWrapper.h"
 #include "core/HTMLNames.h"
 #include "core/MathMLNames.h"
@@ -294,8 +295,8 @@ NodeRareData& Node::ensureRareData() {
     m_data.m_rareData = NodeRareData::create(m_data.m_layoutObject);
 
   DCHECK(m_data.m_rareData);
-
   setFlag(HasRareDataFlag);
+  ScriptWrappableVisitor::writeBarrier(this, rareData());
   return *rareData();
 }
 
@@ -1973,6 +1974,7 @@ void Node::registerMutationObserver(
     registry.append(MutationObserverRegistration::create(
         observer, this, options, attributeFilter));
     registration = registry.last().get();
+    ScriptWrappableVisitor::writeBarrier(this, registration);
   }
 
   document().addMutationObserverTypes(registration->mutationTypes());

third_party/WebKit/Source/core/dom/NodeRareData.h

@@ -22,6 +22,7 @@
 #ifndef NodeRareData_h
 #define NodeRareData_h
 
+#include "bindings/core/v8/ScriptWrappableVisitor.h"
 #include "core/dom/MutationObserverRegistration.h"
 #include "core/dom/NodeListsNodeData.h"
 #include "platform/heap/Handle.h"
@@ -84,8 +85,10 @@ class NodeRareData : public GarbageCollectedFinalized<NodeRareData>,
     return m_mutationObserverData.get();
   }
   NodeMutationObserverData& ensureMutationObserverData() {
-    if (!m_mutationObserverData)
+    if (!m_mutationObserverData) {
       m_mutationObserverData = NodeMutationObserverData::create();
+      ScriptWrappableVisitor::writeBarrier(this, m_mutationObserverData);
+    }
     return *m_mutationObserverData;
   }