IndexedDB: Have IDBCursor and IDBRequest explicitly break ref cycles

Source/modules/indexeddb/IDBRequest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 61 matching lines @@
     , m_result(0)
     , m_contextStopped(false)
     , m_transaction(transaction)
     , m_readyState(PENDING)
     , m_requestAborted(false)
     , m_source(source)
     , m_taskType(taskType)
     , m_hasPendingActivity(true)
     , m_cursorType(IndexedDB::CursorKeyAndValue)
     , m_cursorDirection(IndexedDB::CursorNext)
-    , m_cursorFinished(false)
     , m_pendingCursor(0)
     , m_didFireUpgradeNeededEvent(false)
     , m_preventPropagation(false)
     , m_requestState(context)
 {
     ScriptWrappable::init(this);
 }
 
 IDBRequest::~IDBRequest()
 {
@@ skipping 84 matching lines @@
 }
 
 void IDBRequest::setPendingCursor(PassRefPtr<IDBCursor> cursor)
 {
     ASSERT(m_readyState == DONE);
     ASSERT(scriptExecutionContext());
     ASSERT(m_transaction);
     ASSERT(!m_pendingCursor);
     ASSERT(cursor == getResultCursor());
 
+    m_hasPendingActivity = true;
     m_pendingCursor = cursor;
     m_result.clear();
     m_readyState = PENDING;
     m_error.clear();
     m_transaction->registerRequest(this);
 }
 
-PassRefPtr<IDBCursor> IDBRequest::getResultCursor()
+IDBCursor* IDBRequest::getResultCursor()
 {
     if (!m_result)
         return 0;
     if (m_result->type() == IDBAny::IDBCursorType)
         return m_result->idbCursor();
     if (m_result->type() == IDBAny::IDBCursorWithValueType)
         return m_result->idbCursorWithValue();
     return 0;
 }
 
 void IDBRequest::setResultCursor(PassRefPtr<IDBCursor> cursor, PassRefPtr<IDBKey> key, PassRefPtr<IDBKey> primaryKey, PassRefPtr<SharedBuffer> value)
 {
     ASSERT(m_readyState == PENDING);
     m_cursorKey = key;
     m_cursorPrimaryKey = primaryKey;
     m_cursorValue = value;
 
     if (m_cursorType == IndexedDB::CursorKeyOnly) {
         m_result = IDBAny::create(cursor);
         return;
     }
 
     m_result = IDBAny::create(IDBCursorWithValue::fromCursor(cursor));
 }
 
-void IDBRequest::finishCursor()
+void IDBRequest::checkForReferenceCycle()

[alecflett, 2013/09/06 17:56:35]

It would be neat if there were some primitive around this, i.e.

WTF::RefCountedCycleOwned<T, N>

[jsbell, 2013/09/06 18:07:43]

Yeah. But in the short term this is the only instance I've seen (there are
almost no other types that need to derive from WTF::RefCountedBase) and in the
long term we're betting on Oilpan.

 {
-    m_cursorFinished = true;
-    if (m_readyState != PENDING)
-        m_hasPendingActivity = false;
+    // If this request and its cursor have the only references
+    // to each other, then explicitly break the cycle.
+    IDBCursor* cursor = getResultCursor();
+    if (!cursor || cursor->request() != this)
+        return;
+
+    if (!hasOneRef() || !cursor->hasOneRef())
+        return;
+
+    m_result.clear();
 }
 
 bool IDBRequest::shouldEnqueueEvent() const
 {
     if (m_contextStopped || !scriptExecutionContext())
         return false;
     ASSERT(m_readyState == PENDING || m_readyState == DONE);
     if (m_requestAborted)
         return false;
     ASSERT(m_readyState == PENDING);
@@ skipping 254 matching lines @@
         }
 
         // If this was the last request in the transaction's list, it may commit here.
         if (setTransactionActive)
             m_transaction->setActive(false);
     }
 
     if (cursorToNotify)
         cursorToNotify->postSuccessHandlerCallback();
 
-    if (m_readyState == DONE && (!cursorToNotify || m_cursorFinished) && event->type() != eventNames().upgradeneededEvent)
+    if (m_readyState == DONE && event->type() != eventNames().upgradeneededEvent)
         m_hasPendingActivity = false;
 
     return dontPreventDefault;
 }
 
 void IDBRequest::uncaughtExceptionInEventHandler()
 {
     if (m_transaction && !m_requestAborted) {
         m_transaction->setError(DOMError::create(AbortError, "Uncaught exception in event handler."));
         m_transaction->abort(IGNORE_EXCEPTION);
@@ skipping 30 matching lines @@
 {
     return &m_eventTargetData;
 }
 
 EventTargetData* IDBRequest::ensureEventTargetData()
 {
     return &m_eventTargetData;
 }
 
 } // namespace WebCore