[Oilpan] Move ScrollAnimators onto oilpan heap

third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h

Index: third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
diff --git a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
index ef6286a6f88623a9271e81c22e8b2be6d872e477..670beb6b1dfc8048b140de9eda1f30d2c0eae7ae 100644
--- a/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
+++ b/third_party/WebKit/Source/platform/scroll/ProgrammaticScrollAnimator.h
@@ -9,10 +9,8 @@
 #include "platform/heap/Handle.h"
 #include "public/platform/WebCompositorAnimationDelegate.h"
 #include "public/platform/WebCompositorAnimationPlayerClient.h"
-#include "wtf/Allocator.h"
 #include "wtf/Noncopyable.h"
 #include "wtf/OwnPtr.h"
-#include "wtf/PassOwnPtr.h"
 
 namespace blink {
 
@@ -23,11 +21,10 @@ class WebScrollOffsetAnimationCurve;
 
 // Animator for fixed-destination scrolls, such as those triggered by
 // CSSOM View scroll APIs.
-class ProgrammaticScrollAnimator : private WebCompositorAnimationPlayerClient, WebCompositorAnimationDelegate {
+class ProgrammaticScrollAnimator : public GarbageCollectedFinalized<ProgrammaticScrollAnimator>, private WebCompositorAnimationPlayerClient, WebCompositorAnimationDelegate {

[haraken, 2015/12/03 10:45:49]

You need to change ProgrammaticScrollAnimator to
NoBaseWillBeGarbageCollectedFinalized. Otherwise, it can happen that in
non-oilpan ScrollableArea gets destructed but ProgrammaticScrollAnimator
survives until the next GC is triggered. Then
ProgrammaticScrollAnimator::m_scrollableArea becomes a stale pointer.

[peria, 2015/12/03 13:42:08]

Done.

     WTF_MAKE_NONCOPYABLE(ProgrammaticScrollAnimator);
-    USING_FAST_MALLOC(ProgrammaticScrollAnimator);
 public:
-    static PassOwnPtr<ProgrammaticScrollAnimator> create(ScrollableArea*);
+    static ProgrammaticScrollAnimator* create(ScrollableArea*);
 
     ~ProgrammaticScrollAnimator();
 
@@ -46,6 +43,8 @@ public:
     // WebCompositorAnimationPlayerClient implementation.
     WebCompositorAnimationPlayer* compositorPlayer() const override;
 
+    DECLARE_TRACE();
+
 private:
     explicit ProgrammaticScrollAnimator(ScrollableArea*);
 
@@ -76,8 +75,7 @@ private:
     OwnPtr<WebCompositorAnimationPlayer> m_compositorPlayer;
     int m_compositorAnimationAttachedToLayerId;
 
-    GC_PLUGIN_IGNORE("509911")
-    ScrollableArea* m_scrollableArea;
+    RawPtrWillBeMember<ScrollableArea> m_scrollableArea;
     OwnPtr<WebScrollOffsetAnimationCurve> m_animationCurve;
     FloatPoint m_targetOffset;
     double m_startTime;