[Oilpan] Move ScrollAnimators onto oilpan heap

third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp

Index: third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
diff --git a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
index 85016be74b5a15c2f326a65e4254a439ceac12f6..9787664f13f1b09fb3a8f2bbf6107533df249b4d 100644
--- a/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
+++ b/third_party/WebKit/Source/platform/scroll/ScrollableArea.cpp
@@ -54,7 +54,7 @@ struct SameSizeAsScrollableArea {
 #if ENABLE(ASSERT) && ENABLE(OILPAN)
     VerifyEagerFinalization verifyEager;
 #endif
-    void* pointer;
+    PersistentWillBeMember<void*> persistent[2];
     unsigned bitfields : 16;
     IntPoint origin;
 };
@@ -89,33 +89,34 @@ ScrollableArea::ScrollableArea()
 
 ScrollableArea::~ScrollableArea()
 {
+#if !ENABLE(OILPAN)
+    if (m_scrollAnimator)
+        m_scrollAnimator->cleanup();

[haraken, 2015/12/03 03:47:11]

You don't need this, right?

[peria, 2015/12/03 05:02:14]

This is needed.
On non-oilpan build, ScrollableArea can die before GC runs.
In such a case, Timer in ScrollAnimatorMac can be triggered and tries to access
dead ScrollableArea before GC runs.

+#endif
 }
 
 void ScrollableArea::clearScrollAnimators()
 {
-    m_animators.clear();
+    if (m_scrollAnimator)
+        m_scrollAnimator->cleanup();

[haraken, 2015/12/03 03:47:11]

Ditto.

[peria, 2015/12/03 05:02:14]

This is required.  The failure in PS5 happens as following.
1. m_scrollAnimator (*) is cleared here. (its object is not reachable, but
alive)
2. 'this' object dies, but it has no reference to  (*), the dtor does not clean
it up.
3. Timer in (*) is kicked and tries to access 'this' object. => BAD_ACCESS
4. GC should run and collect untraced ScrollAnimatorMac (*).

+    m_scrollAnimator.clear();
+    m_programmaticScrollAnimator.clear();
 }
 
 ScrollAnimatorBase* ScrollableArea::scrollAnimator() const
 {
-    if (!m_animators)
-        m_animators = adoptPtr(new ScrollableAreaAnimators);
-
-    if (!m_animators->scrollAnimator)
-        m_animators->scrollAnimator = ScrollAnimatorBase::create(const_cast<ScrollableArea*>(this));
+    if (!m_scrollAnimator)
+        m_scrollAnimator = ScrollAnimatorBase::create(const_cast<ScrollableArea*>(this));
 
-    return m_animators->scrollAnimator.get();
+    return m_scrollAnimator.get();
 }
 
 ProgrammaticScrollAnimator* ScrollableArea::programmaticScrollAnimator() const
 {
-    if (!m_animators)
-        m_animators = adoptPtr(new ScrollableAreaAnimators);
+    if (!m_programmaticScrollAnimator)
+        m_programmaticScrollAnimator = ProgrammaticScrollAnimator::create(const_cast<ScrollableArea*>(this));
 
-    if (!m_animators->programmaticScrollAnimator)
-        m_animators->programmaticScrollAnimator = ProgrammaticScrollAnimator::create(const_cast<ScrollableArea*>(this));
-
-    return m_animators->programmaticScrollAnimator.get();
+    return m_programmaticScrollAnimator.get();
 }
 
 void ScrollableArea::setScrollOrigin(const IntPoint& origin)
@@ -584,4 +585,12 @@ IntSize ScrollableArea::excludeScrollbars(const IntSize& size) const
 
 }
 
+DEFINE_TRACE(ScrollableArea)
+{
+#if ENABLE(OILPAN)

[haraken, 2015/12/03 03:47:11]

Remove this.

[peria, 2015/12/03 05:02:14]

Done.

+    visitor->trace(m_scrollAnimator);
+    visitor->trace(m_programmaticScrollAnimator);
+#endif
+}
+
 } // namespace blink