Oilpan: Move WebFrameWidgetImpl into Oilpan heap.

Source/web/WebFrameWidgetImpl.cpp

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 55 matching lines @@
 }
 
 WebFrameWidget* WebFrameWidget::create(WebView* webView)
 {
     return new WebViewFrameWidget(*toWebViewImpl(webView));
 }
 
 WebFrameWidgetImpl* WebFrameWidgetImpl::create(WebWidgetClient* client, WebLocalFrame* localRoot)
 {
     // Pass the WebFrameWidgetImpl's self-reference to the caller.
+#if ENABLE(OILPAN)
+    return new WebFrameWidgetImpl(client, localRoot); // SelfKeepAlive is set in constructor.
+#else
     return adoptRef(new WebFrameWidgetImpl(client, localRoot)).leakRef();
+#endif
 }
 
 // static
 HashSet<WebFrameWidgetImpl*>& WebFrameWidgetImpl::allInstances()
 {
     DEFINE_STATIC_LOCAL(HashSet<WebFrameWidgetImpl*>, allInstances, ());
     return allInstances;
 }
 
 WebFrameWidgetImpl::WebFrameWidgetImpl(WebWidgetClient* client, WebLocalFrame* localRoot)
     : m_client(client)
     , m_localRoot(toWebLocalFrameImpl(localRoot))
     , m_layerTreeView(nullptr)
     , m_rootLayer(nullptr)
     , m_rootGraphicsLayer(nullptr)
     , m_isAcceleratedCompositingActive(false)
     , m_layerTreeViewClosed(false)
     , m_suppressNextKeypressEvent(false)
     , m_ignoreInputEvents(false)
+#if ENABLE(OILPAN)
+    , m_selfKeepAlive(this)
+#endif
 {
     ASSERT(m_localRoot->frame()->isLocalRoot());
     initializeLayerTreeView();
     m_localRoot->setFrameWidget(this);
     allInstances().add(this);
 }
 
 WebFrameWidgetImpl::~WebFrameWidgetImpl()
 {
 }
 
+DEFINE_TRACE(WebFrameWidgetImpl)
+{
+    visitor->trace(m_localRoot);
+    visitor->trace(m_mouseCaptureNode);
+}
+
 // WebWidget ------------------------------------------------------------------
 
 void WebFrameWidgetImpl::close()
 {
     WebDevToolsAgentImpl::webFrameWidgetImplClosed(this);
     ASSERT(allInstances().contains(this));
     allInstances().remove(this);
 
     m_localRoot->setFrameWidget(nullptr);
     m_localRoot = nullptr;
     // Reset the delegate to prevent notifications being sent as we're being
     // deleted.
     m_client = nullptr;

[haraken, 2015/08/18 08:03:08]

Can we clear m_layerTreeView, m_rootLayer, m_rootGraphicsLayer and
m_currentInputEvent as well?

Now that WebFrameWidgetImpl is on the heap, its destruction is delayed until the
next GC happens. Any raw pointer in an on-heap object has a risk of becoming a
stale pointer. We need to clear those raw pointers in an explicit clear point
(like here) or verify that they don't become stale.

[Yuta Kitamura, 2015/08/18 08:33:59]

Done.

 
+#if ENABLE(OILPAN)
+    m_selfKeepAlive.clear();
+#else
     deref(); // Balances ref() acquired in WebFrameWidget::create
+#endif
 }
 
 WebSize WebFrameWidgetImpl::size()
 {
     return m_size;
 }
 
 void WebFrameWidgetImpl::willStartLiveResize()
 {
     if (m_localRoot->frameView())
@@ skipping 897 matching lines @@
     // correspond to Page visibility, but is necessary until we properly sort out OOPIF visibility.
     page()->setVisibilityState(static_cast<PageVisibilityState>(visibilityState), isInitialState);
 
     if (m_layerTreeView) {
         bool visible = visibilityState == WebPageVisibilityStateVisible;
         m_layerTreeView->setVisible(visible);
     }
 }
 
 } // namespace blink