Use registerWeakMembers to clean up IntersectionObserver.

third_party/WebKit/Source/core/dom/IntersectionObserver.cpp

Index: third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
diff --git a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
index b29b69e8b46ed857ca07cd7f76d5b958fd182fe6..2a9cd6f082099d2d6f1c4e72da891af2950a7052 100644
--- a/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
+++ b/third_party/WebKit/Source/core/dom/IntersectionObserver.cpp
@@ -186,7 +186,6 @@ bool IntersectionObserver::isDescendantOfRoot(const Element* target) const
 
 void IntersectionObserver::observe(Element* target, ExceptionState& exceptionState)
 {
-    checkRootAndDetachIfNeeded();
     if (!m_root) {
         exceptionState.throwDOMException(HierarchyRequestError, "Invalid observer: root element or containing document has been deleted.");
         return;
@@ -221,7 +220,6 @@ void IntersectionObserver::observe(Element* target, ExceptionState& exceptionSta
 
 void IntersectionObserver::unobserve(Element* target, ExceptionState&)
 {
-    checkRootAndDetachIfNeeded();
     if (!target || !target->intersectionObserverData())
         return;
     // TODO(szager): unobserve callback
@@ -231,7 +229,6 @@ void IntersectionObserver::unobserve(Element* target, ExceptionState&)
 
 void IntersectionObserver::computeIntersectionObservations(double timestamp)
 {
-    checkRootAndDetachIfNeeded();
     if (!m_root)
         return;
     for (auto& observation : m_observations)
@@ -254,7 +251,6 @@ void IntersectionObserver::removeObservation(IntersectionObservation& observatio
 
 HeapVector<Member<IntersectionObserverEntry>> IntersectionObserver::takeRecords()
 {
-    checkRootAndDetachIfNeeded();
     HeapVector<Member<IntersectionObserverEntry>> entries;
     entries.swap(m_entries);
     return entries;
@@ -299,8 +295,6 @@ unsigned IntersectionObserver::firstThresholdGreaterThan(float ratio) const
 
 void IntersectionObserver::deliver()
 {
-    checkRootAndDetachIfNeeded();
-
     if (m_entries.isEmpty())
         return;
 
@@ -311,7 +305,6 @@ void IntersectionObserver::deliver()
 
 void IntersectionObserver::setActive(bool active)
 {
-    checkRootAndDetachIfNeeded();
     for (auto& observation : m_observations)
         observation->setActive(m_root && active && isDescendantOfRoot(observation->target()));
 }
@@ -324,25 +317,17 @@ bool IntersectionObserver::hasPercentMargin() const
         || m_leftMargin.type() == Percent);
 }
 
-void IntersectionObserver::checkRootAndDetachIfNeeded()
+void IntersectionObserver::rootDisappearedCallback(Visitor* visitor, void* self)
 {
-#if ENABLE(OILPAN)
-    // TODO(szager): Pre-oilpan, ElementIntersectionObserverData::dispose() will take
-    // care of this cleanup.  When oilpan ships, there will be a potential leak of the
-    // callback's execution context when the root goes away.  For a detailed explanation:
-    //
-    //   https://goo.gl/PC2Baj
-    //
-    // When that happens, this method should catch most potential leaks, but a complete
-    // solution will still be needed, along the lines described in the above link.
-    if (m_root)
-        return;
-    disconnect();
-#endif
+    IntersectionObserver* observer = static_cast<IntersectionObserver*>(self);
+    observer->disconnect();
 }
 
 DEFINE_TRACE(IntersectionObserver)
 {
+#if ENABLE(OILPAN)

[sof, 2016/01/16 09:17:18]

How is this supposed to work? A weak callback is registered for m_root and we
trace it separately. Doesn't that mean the m_root could be cleared before the
weak callback is invoked?

+    visitor->registerWeakMembers(this, m_root.get(), IntersectionObserver::rootDisappearedCallback);
+#endif
     visitor->trace(m_callback);
     visitor->trace(m_root);

[haraken, 2016/01/16 09:25:17]

Good point... We need to remove this.

     visitor->trace(m_observations);