Oilpan: handle delayed removal of PromiseTracker promises.

When a PromiseTracker is disabled as part of shutting down, it clears
its ID -> vector(PromiseData) map. However, once the unfulfilled
promises in that cleared map later on have their weak callbacks
invoked, we weren't prepared for the map being empty. Add the required
empty map check.

A further twist for Oilpan is that the ScopedPersistents held on the
PromiseData objects need to be cleared out eagerly to prevent v8
assuming that these objects will leak -- they won't, but will only be
cleared at the next Oilpan GC. Be more eager, and promptly clear out
the references.

R=haraken
BUG=414163

Review URL: https://codereview.chromium.org/571043002

git-svn-id: svn://svn.chromium.org/blink/trunk@181979 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/inspector/PromiseTracker.cpp

@@ -27,7 +27,13 @@ public:
     int promiseHash() const { return m_promiseHash; }
     ScopedPersistent<v8::Object>& promise() { return m_promise; }
 
-#if !ENABLE(OILPAN)
+#if ENABLE(OILPAN)
+    void dispose()
+    {
+        m_promise.clear();
+        m_parentPromise.clear();
+    }
+#else
     WeakPtr<PromiseData> createWeakPtr()
     {
         return m_weakPtrFactory.createWeakPtr();
@@ -103,9 +109,23 @@ public:
         WeakPtrWillBeRawPtr<PromiseTracker::PromiseData> promiseData = wrapper->m_data;
         if (!promiseData || !wrapper->m_tracker)
             return;
+
+#if ENABLE(OILPAN)
+        // Oilpan: let go of ScopedPersistent<>s right here (and not wait until the
+        // PromiseDataWrapper is GCed later.) The v8 weak callback handling expects
+        // to see the callback data upon return.
+        promiseData->dispose();
+#endif
         PromiseTracker::PromiseDataMap& map = wrapper->m_tracker->promiseDataMap();
         int promiseHash = promiseData->promiseHash();
-        PromiseTracker::PromiseDataVector* vector = &map.find(promiseHash)->value;
+
+        PromiseTracker::PromiseDataMap::iterator it = map.find(promiseHash);
+        // The PromiseTracker may have been disabled (and, possibly, re-enabled later),
+        // leaving the promiseHash as unmapped.
+        if (it == map.end())
+            return;
+
+        PromiseTracker::PromiseDataVector* vector = &it->value;
         int index = indexOf(vector, promiseData->promise());
         ASSERT(index >= 0);
         vector->remove(index);