Oilpan: have Navigator and its supplements be on the heap by default.

Source/modules/gamepad/NavigatorGamepad.h

Index: Source/modules/gamepad/NavigatorGamepad.h
diff --git a/Source/modules/gamepad/NavigatorGamepad.h b/Source/modules/gamepad/NavigatorGamepad.h
index 68eb8a0629f7e73484396a41843b88026cdc0c7a..3ea11acc5743923e601610fe809c634c0e3014d0 100644
--- a/Source/modules/gamepad/NavigatorGamepad.h
+++ b/Source/modules/gamepad/NavigatorGamepad.h
@@ -42,8 +42,9 @@ class Gamepad;
 class GamepadList;
 class Navigator;
 
-class MODULES_EXPORT NavigatorGamepad final : public NoBaseWillBeGarbageCollectedFinalized<NavigatorGamepad>, public WillBeHeapSupplement<Navigator>, public DOMWindowProperty, public PlatformEventController, public DOMWindowLifecycleObserver {
-    WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(NavigatorGamepad);
+// TODO(Oilpan): when ~DOMWindowProperty is removed, derive from GarbageCollected<> instead.

[haraken, 2015/04/24 15:32:36]

Can we move these comments to DOMWindowProperty and remove them from each
subclass? I guess we'll need to add more comments in the future.

[sof, 2015/04/24 21:25:08]

Done; I considered some time ago adding DOMWindowPropertyGarbageCollected which
would be a GarbageCollectedMixin, but I don't think the churn is worth it.

+class MODULES_EXPORT NavigatorGamepad final : public GarbageCollectedFinalized<NavigatorGamepad>, public HeapSupplement<Navigator>, DOMWindowProperty, public PlatformEventController, public DOMWindowLifecycleObserver {
+    USING_GARBAGE_COLLECTED_MIXIN(NavigatorGamepad);
 public:
     static NavigatorGamepad* from(Document&);
     static NavigatorGamepad& from(Navigator&);
@@ -81,8 +82,8 @@ private:
     virtual void didRemoveEventListener(LocalDOMWindow*, const AtomicString&) override;
     virtual void didRemoveAllEventListeners(LocalDOMWindow*) override;
 
-    PersistentWillBeMember<GamepadList> m_gamepads;
-    PersistentHeapDequeWillBeHeapDeque<Member<Gamepad>> m_pendingEvents;
+    Member<GamepadList> m_gamepads;
+    HeapDeque<Member<Gamepad>> m_pendingEvents;
     AsyncMethodRunner<NavigatorGamepad> m_dispatchOneEventRunner;

[haraken, 2015/04/24 15:37:17]

It seems that AsyncMethodRunner is not safe for lazy sweeping. I think we need
to implement the isHeapObjectAlive logic we implemented for Timer::fired()
(https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...)
for AsyncMethodRunner::fired() as well.

[sof, 2015/04/24 15:40:10]

You have looked at the comment next to AsyncMethodRunner::m_object ?

[haraken, 2015/04/24 15:44:44]

That is a different issue than the issue mentioned in the comment.

AsyncMethodRunner::fired() can call a function that can touch other on-heap
objects that have been already swept in the lazy sweeping. If the m_object is
going to be swept soon in the current lazy sweeping, we should avoid invoking
the fired() method. You've taken care of the problem for Timer by implementing
TimerIsObjectAliveTrait, and I think we need the same mechanism here.

[sof, 2015/04/24 15:55:13]

Thanks, now I remember the non-local nature of this problem. I suppose we would
get it for "free" if AsyncMethodRunner was on the heap -- it's Timer would then
do the check before firing.

[sof, 2015/04/24 21:25:08]

Addressing this one via https://codereview.chromium.org/1108663002/

 };