Oilpan: trace ColorChooserPopupUIController::m_chromeClient

third_party/WebKit/Source/web/ColorChooserPopupUIController.h

Index: third_party/WebKit/Source/web/ColorChooserPopupUIController.h
diff --git a/third_party/WebKit/Source/web/ColorChooserPopupUIController.h b/third_party/WebKit/Source/web/ColorChooserPopupUIController.h
index 4e3f10f06a8711782a3ca4bf33defad6f020a579..d3e6d7e6bcf5bf88f1e54dab349224b4891b29de 100644
--- a/third_party/WebKit/Source/web/ColorChooserPopupUIController.h
+++ b/third_party/WebKit/Source/web/ColorChooserPopupUIController.h
@@ -64,12 +64,18 @@ public:
     Element& ownerElement() override;
     void didClosePopup() override;
 
+    DEFINE_INLINE_VIRTUAL_TRACE()
+    {
+        visitor->trace(m_chromeClient);
+        ColorChooserUIController::trace(visitor);
+    }
+
 private:
     ColorChooserPopupUIController(LocalFrame*, ChromeClientImpl*, ColorChooserClient*);
 
     void openPopup();
 
-    ChromeClientImpl* m_chromeClient;
+    RawPtrWillBeMember<ChromeClientImpl> m_chromeClient;

[haraken, 2015/11/12 14:17:29]

It seems that the destructor is touching m_chromeClient in closePopup()...

[sof, 2015/11/13 07:35:01]

Good catch.

Hmm, given that ChromeClientImpl is held in a Persistent<> by WebViewImpl, it is
not too likely it will be swept in the same GC iteration. If it is, we're in the
middle of a global shutdown, so having closePopup() inform this client that it
is going away seems irrelevant.

=> Introducing a WeakMember<> here looks like the better option overall. Now
done.

     PagePopup* m_popup;
     Locale& m_locale;
 };