[Oilpan] Move ScrollAnimators onto oilpan heap

third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef ProgrammaticScrollAnimator_h
 #define ProgrammaticScrollAnimator_h
 
 #include "platform/geometry/FloatPoint.h"
 #include "platform/heap/Handle.h"
 #include "public/platform/WebCompositorAnimationDelegate.h"
 #include "public/platform/WebCompositorAnimationPlayerClient.h"
-#include "wtf/Allocator.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/OwnPtr.h"
-#include "wtf/PassOwnPtr.h"
 
 namespace blink {
 
 class ScrollableArea;
 class WebCompositorAnimationPlayer;
 class WebCompositorAnimationTimeline;
 class WebScrollOffsetAnimationCurve;
 
 // Animator for fixed-destination scrolls, such as those triggered by
 // CSSOM View scroll APIs.
-class ProgrammaticScrollAnimator : private WebCompositorAnimationPlayerClient, WebCompositorAnimationDelegate {
+class ProgrammaticScrollAnimator : public GarbageCollectedFinalized<ProgrammaticScrollAnimator>, private WebCompositorAnimationPlayerClient, WebCompositorAnimationDelegate {

[haraken, 2015/12/03 10:45:49]

You need to change ProgrammaticScrollAnimator to
NoBaseWillBeGarbageCollectedFinalized. Otherwise, it can happen that in
non-oilpan ScrollableArea gets destructed but ProgrammaticScrollAnimator
survives until the next GC is triggered. Then
ProgrammaticScrollAnimator::m_scrollableArea becomes a stale pointer.

[peria, 2015/12/03 13:42:08]

Done.

     WTF_MAKE_NONCOPYABLE(ProgrammaticScrollAnimator);
-    USING_FAST_MALLOC(ProgrammaticScrollAnimator);
 public:
-    static PassOwnPtr<ProgrammaticScrollAnimator> create(ScrollableArea*);
+    static ProgrammaticScrollAnimator* create(ScrollableArea*);
 
     ~ProgrammaticScrollAnimator();
 
     void scrollToOffsetWithoutAnimation(const FloatPoint&);
     void animateToOffset(FloatPoint);
     void cancelAnimation();
     void tickAnimation(double monotonicTime);
     bool hasAnimationThatRequiresService() const;
     void updateCompositorAnimations();
     void layerForCompositedScrollingDidChange(WebCompositorAnimationTimeline*);
     void notifyCompositorAnimationFinished(int groupId);
     // WebCompositorAnimationDelegate implementation.
     void notifyAnimationStarted(double monotonicTime, int group) override;
     void notifyAnimationFinished(double monotonicTime, int group) override;
 
     // WebCompositorAnimationPlayerClient implementation.
     WebCompositorAnimationPlayer* compositorPlayer() const override;
 
+    DECLARE_TRACE();
+
 private:
     explicit ProgrammaticScrollAnimator(ScrollableArea*);
 
     enum class RunState {
         // No animation.
         Idle,
 
         // Waiting to send an animation to the compositor. There might also
         // already be another animation running on the compositor that will need
         // to be canceled first.
@@ skipping 10 matching lines @@
         WaitingToCancelOnCompositor
     };
 
     void resetAnimationState();
     void notifyPositionChanged(const DoublePoint&);
     void reattachCompositorPlayerIfNeeded(WebCompositorAnimationTimeline*);
 
     OwnPtr<WebCompositorAnimationPlayer> m_compositorPlayer;
     int m_compositorAnimationAttachedToLayerId;
 
-    GC_PLUGIN_IGNORE("509911")
-    ScrollableArea* m_scrollableArea;
+    RawPtrWillBeMember<ScrollableArea> m_scrollableArea;
     OwnPtr<WebScrollOffsetAnimationCurve> m_animationCurve;
     FloatPoint m_targetOffset;
     double m_startTime;
     RunState m_runState;
     int m_compositorAnimationId;
     int m_compositorAnimationGroupId;
 };
 
 } // namespace blink
 
 #endif // ProgrammaticScrollAnimator_h