Oilpan: Prepare moving AXObject to heap

Source/modules/accessibility/AXNodeObject.h

Index: Source/modules/accessibility/AXNodeObject.h
diff --git a/Source/modules/accessibility/AXNodeObject.h b/Source/modules/accessibility/AXNodeObject.h
index 65c42bf4197d83ec24a835a6f1fa45dab15ff25f..aceceb631c79170bc2b27de85be1b8a240fdd28d 100644
--- a/Source/modules/accessibility/AXNodeObject.h
+++ b/Source/modules/accessibility/AXNodeObject.h
@@ -46,8 +46,9 @@ protected:
     AXNodeObject(Node*, AXObjectCacheImpl*);
 
 public:
-    static PassRefPtr<AXNodeObject> create(Node*, AXObjectCacheImpl*);
+    static PassRefPtrWillBeRawPtr<AXNodeObject> create(Node*, AXObjectCacheImpl*);
     virtual ~AXNodeObject();
+    DECLARE_VIRTUAL_TRACE();
 
 protected:
     // Protected data.
@@ -203,11 +204,11 @@ protected:
     virtual int setSize() const override;
 
 private:
-    Node* m_node;
+    RawPtrWillBeWeakMember<Node> m_node;

[dmazzoni, 2015/04/28 06:53:25]

So this is safe from use-after-free, but I think it will leak AXNodeObjects.
Currently we rely on knowing when the Node is removed from the document to
actually call detach() on AXNodeObject. We need some sort of equivalent - a
callback so that we can detach an AXNodeObject when it no longer points to a
valid node, and eventually delete it from the HashMap.

[keishi, 2015/05/28 06:49:19]

Like I answered in my reply for the m_nodeObjectMapping part, I think
AXNodeObject::detach is called when AXObjectCacheImpl::remove is called from
AXObjectCacheImpl::clearWeakMembers.

 
     String alternativeTextForWebArea() const;
-    void alternativeText(Vector<AccessibilityText>&) const;
-    void ariaLabeledByText(Vector<AccessibilityText>&) const;
+    void alternativeText(WillBeHeapVector<OwnPtrWillBeMember<AccessibilityText>>&) const;
+    void ariaLabeledByText(WillBeHeapVector<OwnPtrWillBeMember<AccessibilityText>>&) const;
     float stepValueForRange() const;
     AXObject* findChildWithTagName(const HTMLQualifiedName&) const;
     bool isDescendantOfElementType(const HTMLQualifiedName& tagName) const;