Allow wrapper objects to be created during DOMWrapperMap::clear()
Allow wrapper objects to be created during DOMWrapperMap::clear()

Crashes have been seen in the wild in which a DOMWrapperMap's weak handle
callback is called after it's been deleted. This suggests that the call
to derefObject() inside clear()'s loop through the map is re-entering JS
and creating more wrappers, thus adding them to the map. By swapping out
the map before iterating, we ensure both that all wrappers are cleared by
the time clear() exits and that any calls to DOMWrapperMap::get() during
clear() will return empty handles (rather than bogus handles).

R=abarth
BUG=232743

Review URL: https://codereview.chromium.org/14330019

git-svn-id: bf5cd6ccde378db821296732a091cfbcf5285fbd@148676 bbb929c8-8fbe-4397-9dbb-9b2b20218538

primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs,primiano/blink-gitcs