Oilpan: Move WebFrameWidgetImpl into Oilpan heap.

Source/web/WebFrameWidgetImpl.cpp

Index: Source/web/WebFrameWidgetImpl.cpp
diff --git a/Source/web/WebFrameWidgetImpl.cpp b/Source/web/WebFrameWidgetImpl.cpp
index 4872a33bdb0111a27fb7df683f6c00cec9642add..0959b5eea4039aa0c8df9e1d28b89f7de87ff5ab 100644
--- a/Source/web/WebFrameWidgetImpl.cpp
+++ b/Source/web/WebFrameWidgetImpl.cpp
@@ -73,7 +73,11 @@ WebFrameWidget* WebFrameWidget::create(WebView* webView)
 WebFrameWidgetImpl* WebFrameWidgetImpl::create(WebWidgetClient* client, WebLocalFrame* localRoot)
 {
     // Pass the WebFrameWidgetImpl's self-reference to the caller.
+#if ENABLE(OILPAN)
+    return new WebFrameWidgetImpl(client, localRoot); // SelfKeepAlive is set in constructor.
+#else
     return adoptRef(new WebFrameWidgetImpl(client, localRoot)).leakRef();
+#endif
 }
 
 // static
@@ -93,6 +97,9 @@ WebFrameWidgetImpl::WebFrameWidgetImpl(WebWidgetClient* client, WebLocalFrame* l
     , m_layerTreeViewClosed(false)
     , m_suppressNextKeypressEvent(false)
     , m_ignoreInputEvents(false)
+#if ENABLE(OILPAN)
+    , m_selfKeepAlive(this)
+#endif
 {
     ASSERT(m_localRoot->frame()->isLocalRoot());
     initializeLayerTreeView();
@@ -104,6 +111,12 @@ WebFrameWidgetImpl::~WebFrameWidgetImpl()
 {
 }
 
+DEFINE_TRACE(WebFrameWidgetImpl)
+{
+    visitor->trace(m_localRoot);
+    visitor->trace(m_mouseCaptureNode);
+}
+
 // WebWidget ------------------------------------------------------------------
 
 void WebFrameWidgetImpl::close()
@@ -118,7 +131,11 @@ void WebFrameWidgetImpl::close()
     // deleted.
     m_client = nullptr;

[haraken, 2015/08/18 08:03:08]

Can we clear m_layerTreeView, m_rootLayer, m_rootGraphicsLayer and
m_currentInputEvent as well?

Now that WebFrameWidgetImpl is on the heap, its destruction is delayed until the
next GC happens. Any raw pointer in an on-heap object has a risk of becoming a
stale pointer. We need to clear those raw pointers in an explicit clear point
(like here) or verify that they don't become stale.

[Yuta Kitamura, 2015/08/18 08:33:59]

Done.

 
+#if ENABLE(OILPAN)
+    m_selfKeepAlive.clear();
+#else
     deref(); // Balances ref() acquired in WebFrameWidget::create
+#endif
 }
 
 WebSize WebFrameWidgetImpl::size()