Oilpan: Move the EventListener hierarchy to Oilpan's heap

Source/core/events/EventTarget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ skipping 39 matching lines @@
 namespace blink {
 
 EventTargetData::EventTargetData()
 {
 }
 
 EventTargetData::~EventTargetData()
 {
 }
 
+DEFINE_TRACE(EventTargetData)
+{
+    visitor->trace(eventListenerMap);
+}
+
 EventTarget::EventTarget()
 {
 }
 
 EventTarget::~EventTarget()
 {
 }
 
 Node* EventTarget::toNode()
 {
@@ skipping 10 matching lines @@
     return 0;
 }
 
 inline LocalDOMWindow* EventTarget::executingWindow()
 {
     if (ExecutionContext* context = executionContext())
         return context->executingWindow();
     return 0;
 }
 
-bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+bool EventTarget::addEventListener(const AtomicString& eventType, PassRefPtrWillBeRawPtr<EventListener> listener, bool useCapture)
 {
     if (!listener)
         return false;
 
     V8DOMActivityLogger* activityLogger = V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld();
     if (activityLogger) {
         Vector<String> argv;
         argv.append(toNode() ? toNode()->nodeName() : interfaceName());
         argv.append(eventType);
         activityLogger->logEvent("blinkAddEventListener", argv.size(), argv.data());
     }
 
     return ensureEventTargetData().eventListenerMap.add(eventType, listener, useCapture);
 }
 
-bool EventTarget::removeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+bool EventTarget::removeEventListener(const AtomicString& eventType, PassRefPtrWillBeRawPtr<EventListener> listener, bool useCapture)
 {
     if (!listener)
         return false;
 
     EventTargetData* d = eventTargetData();
     if (!d)
         return false;
 
     size_t indexOfRemovedListener;
 
@@ skipping 17 matching lines @@
         // firingIterator.iterator indicates the next event listener
         // that would fire, not the currently firing event
         // listener. See EventTarget::fireEventListeners.
         if (indexOfRemovedListener < firingIterator.iterator)
             --firingIterator.iterator;
     }
 
     return true;
 }
 
-bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+bool EventTarget::setAttributeEventListener(const AtomicString& eventType, PassRefPtrWillBeRawPtr<EventListener> listener)
 {
     clearAttributeEventListener(eventType);
     if (!listener)
         return false;
     return addEventListener(eventType, listener, false);
 }
 
 EventListener* EventTarget::getAttributeEventListener(const AtomicString& eventType)
 {
-    const EventListenerVector& entry = getEventListeners(eventType);
-    for (const auto& eventListener : entry) {
+    EventListenerVector* listenerVector = getEventListeners(eventType);
+    if (!listenerVector)
+        return nullptr;
+    for (const auto& eventListener : *listenerVector) {
         EventListener* listener = eventListener.listener.get();
         if (listener->isAttribute() && listener->belongsToTheCurrentWorld())
             return listener;
     }
-    return 0;
+    return nullptr;
 }
 
 bool EventTarget::clearAttributeEventListener(const AtomicString& eventType)
 {
     EventListener* listener = getAttributeEventListener(eventType);
     if (!listener)
         return false;
     return removeEventListener(eventType, listener, false);
 }
 
@@ skipping 188 matching lines @@
         // To match Mozilla, the AT_TARGET phase fires both capturing and bubbling
         // event listeners, even though that violates some versions of the DOM spec.
         registeredListener.listener->handleEvent(context, event);
         RELEASE_ASSERT(i <= size);
 
         InspectorInstrumentation::didHandleEvent(cookie);
     }
     d->firingEventIterators->removeLast();
 }
 
-const EventListenerVector& EventTarget::getEventListeners(const AtomicString& eventType)
+EventListenerVector* EventTarget::getEventListeners(const AtomicString& eventType)
 {
-    AtomicallyInitializedStaticReference(EventListenerVector, emptyVector, new EventListenerVector);

[haraken, 2015/07/27 15:07:29]

It took me hours to notice this bug... The created EventListenerVector gets
collected because it is not stored in a persistent handle.

The GC plugin should detect this kind of programming error.

-
-    EventTargetData* d = eventTargetData();
-    if (!d)
-        return emptyVector;
-
-    EventListenerVector* listenerVector = d->eventListenerMap.find(eventType);
-    if (!listenerVector)
-        return emptyVector;
-
-    return *listenerVector;
+    EventTargetData* data = eventTargetData();
+    if (!data)
+        return nullptr;
+    return data->eventListenerMap.find(eventType);
 }
 
 Vector<AtomicString> EventTarget::eventTypes()
 {
     EventTargetData* d = eventTargetData();
     return d ? d->eventListenerMap.eventTypes() : Vector<AtomicString>();
 }
 
 void EventTarget::removeAllEventListeners()
 {
     EventTargetData* d = eventTargetData();
     if (!d)
         return;
     d->eventListenerMap.clear();
 
     // Notify firing events planning to invoke the listener at 'index' that
     // they have one less listener to invoke.
     if (d->firingEventIterators) {
         for (size_t i = 0; i < d->firingEventIterators->size(); ++i) {
             d->firingEventIterators->at(i).iterator = 0;
             d->firingEventIterators->at(i).end = 0;
         }
     }
 }
 
 } // namespace blink