Oilpan: Prepare moving AXObject to heap

Source/modules/accessibility/AXNodeObject.h

 /*
  * Copyright (C) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 28 matching lines @@
 class Element;
 class HTMLLabelElement;
 class LayoutRect;
 class Node;
 
 class MODULES_EXPORT AXNodeObject : public AXObject {
 protected:
     AXNodeObject(Node*, AXObjectCacheImpl*);
 
 public:
-    static PassRefPtr<AXNodeObject> create(Node*, AXObjectCacheImpl*);
+    static PassRefPtrWillBeRawPtr<AXNodeObject> create(Node*, AXObjectCacheImpl*);
     virtual ~AXNodeObject();
+    DECLARE_VIRTUAL_TRACE();
 
 protected:
     // Protected data.
     AccessibilityRole m_ariaRole;
     bool m_childrenDirty;
 #if ENABLE(ASSERT)
     bool m_initialized;
 #endif
 
     virtual bool computeAccessibilityIsIgnored(IgnoredReasons* = nullptr) const override;
@@ skipping 135 matching lines @@
     virtual void childrenChanged() override;
     virtual void selectionChanged() override final;
     virtual void textChanged() override;
     virtual void updateAccessibilityRole() override final;
 
     // Position in set and Size of set
     virtual int posInSet() const override;
     virtual int setSize() const override;
 
 private:
-    Node* m_node;
+    RawPtrWillBeWeakMember<Node> m_node;

[dmazzoni, 2015/04/28 06:53:25]

So this is safe from use-after-free, but I think it will leak AXNodeObjects.
Currently we rely on knowing when the Node is removed from the document to
actually call detach() on AXNodeObject. We need some sort of equivalent - a
callback so that we can detach an AXNodeObject when it no longer points to a
valid node, and eventually delete it from the HashMap.

[keishi, 2015/05/28 06:49:19]

Like I answered in my reply for the m_nodeObjectMapping part, I think
AXNodeObject::detach is called when AXObjectCacheImpl::remove is called from
AXObjectCacheImpl::clearWeakMembers.

 
     String alternativeTextForWebArea() const;
-    void alternativeText(Vector<AccessibilityText>&) const;
-    void ariaLabeledByText(Vector<AccessibilityText>&) const;
+    void alternativeText(WillBeHeapVector<OwnPtrWillBeMember<AccessibilityText>>&) const;
+    void ariaLabeledByText(WillBeHeapVector<OwnPtrWillBeMember<AccessibilityText>>&) const;
     float stepValueForRange() const;
     AXObject* findChildWithTagName(const HTMLQualifiedName&) const;
     bool isDescendantOfElementType(const HTMLQualifiedName& tagName) const;
 };
 
 DEFINE_AX_OBJECT_TYPE_CASTS(AXNodeObject, isAXNodeObject());
 
 } // namespace blink
 
 #endif // AXNodeObject_h