Change various helper classes to transition types to get CSSValue entirely onto the gc heap.

Source/core/css/MediaList.h

Index: Source/core/css/MediaList.h
diff --git a/Source/core/css/MediaList.h b/Source/core/css/MediaList.h
index 80223b034213ebf19028667f009432afe9241721..83c82ba89a88259e8a4be5e4df834757c5fcb034 100644
--- a/Source/core/css/MediaList.h
+++ b/Source/core/css/MediaList.h
@@ -22,6 +22,7 @@
 #define MediaList_h
 
 #include "core/dom/ExceptionCode.h"
+#include "heap/Handle.h"
 #include "wtf/Forward.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
@@ -37,43 +38,47 @@ class ExceptionState;
 class MediaList;
 class MediaQuery;
 
-class MediaQuerySet : public RefCounted<MediaQuerySet> {
+class MediaQuerySet : public RefCountedWillBeGarbageCollected<MediaQuerySet> {
+    DECLARE_GC_INFO;
 public:
-    static PassRefPtr<MediaQuerySet> create()
+    static PassRefPtrWillBeRawPtr<MediaQuerySet> create()
     {
-        return adoptRef(new MediaQuerySet());
+        return adoptRefWillBeNoop(new MediaQuerySet());
     }
-    static PassRefPtr<MediaQuerySet> create(const String& mediaString);
+    static PassRefPtrWillBeRawPtr<MediaQuerySet> create(const String& mediaString);
     ~MediaQuerySet();
 
     bool set(const String&);
     bool add(const String&);
     bool remove(const String&);
 
-    void addMediaQuery(PassOwnPtr<MediaQuery>);
+    void addMediaQuery(PassOwnPtrWillBeRawPtr<MediaQuery>);
 
-    const Vector<OwnPtr<MediaQuery> >& queryVector() const { return m_queries; }
+    const WillBeHeapVector<OwnPtrWillBeMember<MediaQuery> >& queryVector() const { return m_queries; }
 
     String mediaText() const;
 
-    PassRefPtr<MediaQuerySet> copy() const { return adoptRef(new MediaQuerySet(*this)); }
+    PassRefPtrWillBeRawPtr<MediaQuerySet> copy() const { return adoptRefWillBeNoop(new MediaQuerySet(*this)); }
+
+    void trace(Visitor*);
 
 private:
     MediaQuerySet();
     MediaQuerySet(const MediaQuerySet&);
 
-    Vector<OwnPtr<MediaQuery> > m_queries;
+    WillBeHeapVector<OwnPtrWillBeMember<MediaQuery> > m_queries;
 };
 
-class MediaList : public RefCounted<MediaList> {
+class MediaList : public RefCountedWillBeGarbageCollectedFinalized<MediaList> {
+    DECLARE_GC_INFO;
 public:
-    static PassRefPtr<MediaList> create(MediaQuerySet* mediaQueries, CSSStyleSheet* parentSheet)
+    static PassRefPtrWillBeRawPtr<MediaList> create(MediaQuerySet* mediaQueries, CSSStyleSheet* parentSheet)
     {
-        return adoptRef(new MediaList(mediaQueries, parentSheet));
+        return adoptRefWillBeNoop(new MediaList(mediaQueries, parentSheet));
     }
-    static PassRefPtr<MediaList> create(MediaQuerySet* mediaQueries, CSSRule* parentRule)
+    static PassRefPtrWillBeRawPtr<MediaList> create(MediaQuerySet* mediaQueries, CSSRule* parentRule)
     {
-        return adoptRef(new MediaList(mediaQueries, parentRule));
+        return adoptRefWillBeNoop(new MediaList(mediaQueries, parentRule));
     }
 
     ~MediaList();
@@ -95,12 +100,14 @@ public:
 
     void reattach(MediaQuerySet*);
 
+    void trace(Visitor*);
+
 private:
     MediaList();
     MediaList(MediaQuerySet*, CSSStyleSheet* parentSheet);
     MediaList(MediaQuerySet*, CSSRule* parentRule);
 
-    RefPtr<MediaQuerySet> m_mediaQueries;
+    RefPtrWillBeMember<MediaQuerySet> m_mediaQueries;
     CSSStyleSheet* m_parentStyleSheet;
     CSSRule* m_parentRule;

[haraken, 2014/02/21 01:02:36]

The lifetime of these raw pointers are a bit complicated, and it's not obvious
that they don't cause lifetime issue when MediaList outlives CSSStyleSheet or
CSSRule. Would you double-check it and add a comment?

[wibling-chromium, 2014/02/21 08:43:08]

Yes, I will investigate it a bit further.

[wibling-chromium, 2014/02/25 12:07:28]

From what I can tell there are three callers to MediaList::create.

CSSStyleSheet.cpp:374
CSSMediaRule.cpp:66
CSSImportRule.cpp:55

The first sets the m_parentStyleSheet raw pointer and clears it via
clearParentStyleSheet when it is destructed. The two latter sets m_parentRule
and clears it via clearParentRule when they are destructed. AFAICT this is okay
and we should not have a dangling raw pointer to either in the case MediaList
outlives them.

[haraken, 2014/02/25 12:09:57]

Got it, thanks!

 };