[oilpan] Move CSSFontFace and CSSSegmentedFontFace to the managed heap

Source/core/css/CSSSegmentedFontFace.cpp

Index: Source/core/css/CSSSegmentedFontFace.cpp
diff --git a/Source/core/css/CSSSegmentedFontFace.cpp b/Source/core/css/CSSSegmentedFontFace.cpp
index 420368a25a25c494eb59d8f062b729abbc51ba01..f388f7bfbf3e065f93fa24a2f8f16f681b47ca90 100644
--- a/Source/core/css/CSSSegmentedFontFace.cpp
+++ b/Source/core/css/CSSSegmentedFontFace.cpp
@@ -37,6 +37,9 @@
 
 namespace WebCore {
 
+DEFINE_GC_TYPE_MARKER(CSSSegmentedFontFace);
+DEFINE_GC_TYPE_MARKER(CSSSegmentedFontFace::LoadFontCallback);
+
 CSSSegmentedFontFace::CSSSegmentedFontFace(CSSFontSelector* fontSelector)
     : m_fontSelector(fontSelector)
 {
@@ -45,9 +48,6 @@ CSSSegmentedFontFace::CSSSegmentedFontFace(CSSFontSelector* fontSelector)
 CSSSegmentedFontFace::~CSSSegmentedFontFace()
 {
     pruneTable();
-    unsigned size = m_fontFaces.size();
-    for (unsigned i = 0; i < size; i++)
-        m_fontFaces[i]->removedFromSegmentedFontFace(this);

[haraken, 2013/07/03 12:03:23]

We have to remove this. Since we're in a destructor, there is a possibility that
Members in the HashSet are already freed.

(Now I understand erik's point that we don't want to call destructors in the
sweep phase -- it's likely to cause use-after-free.)

[Mads Ager (google), 2013/07/03 12:18:38]

Right, just to be clear on this. The lifetime of the FontFace and the
SegmentedFontFace are now always linked, right? So this code is safe to remove
since both things die at the same time?

 }
 
 void CSSSegmentedFontFace::pruneTable()
@@ -70,26 +70,26 @@ bool CSSSegmentedFontFace::isValid() const
     return false;
 }
 
-void CSSSegmentedFontFace::fontLoaded(CSSFontFace*)
+void CSSSegmentedFontFace::fontLoaded(Handle<CSSFontFace>)
 {
     pruneTable();
 
     if (RuntimeEnabledFeatures::fontLoadEventsEnabled() && !isLoading()) {
-        Vector<RefPtr<LoadFontCallback> > callbacks;
-        m_callbacks.swap(callbacks);
-        for (size_t index = 0; index < callbacks.size(); ++index) {
+        CollectionRoot<Vector<Member<LoadFontCallback> > > callbacks;
+        m_callbacks.swap(*callbacks);
+        for (size_t index = 0; index < callbacks->size(); ++index) {
             if (checkFont())
-                callbacks[index]->notifyLoaded(this);
+                callbacks->at(index)->notifyLoaded(Handle<CSSSegmentedFontFace>(this));
             else
-                callbacks[index]->notifyError(this);
+                callbacks->at(index)->notifyError(Handle<CSSSegmentedFontFace>(this));
         }
     }
 }
 
-void CSSSegmentedFontFace::appendFontFace(PassRefPtr<CSSFontFace> fontFace)
+void CSSSegmentedFontFace::appendFontFace(Handle<CSSFontFace> fontFace)
 {
     pruneTable();
-    fontFace->addedToSegmentedFontFace(this);
+    fontFace->addedToSegmentedFontFace(Handle<CSSSegmentedFontFace>(this));
     m_fontFaces.append(fontFace);
 }
 
@@ -167,7 +167,7 @@ bool CSSSegmentedFontFace::checkFont() const
     return true;
 }
 
-void CSSSegmentedFontFace::loadFont(const FontDescription& fontDescription, PassRefPtr<LoadFontCallback> callback)
+void CSSSegmentedFontFace::loadFont(const FontDescription& fontDescription, Handle<LoadFontCallback> callback)
 {
     getFontData(fontDescription); // Kick off the load.
 
@@ -175,10 +175,16 @@ void CSSSegmentedFontFace::loadFont(const FontDescription& fontDescription, Pass
         if (isLoading())
             m_callbacks.append(callback);
         else if (checkFont())
-            callback->notifyLoaded(this);
+            callback->notifyLoaded(Handle<CSSSegmentedFontFace>(this));
         else
-            callback->notifyError(this);
+            callback->notifyError(Handle<CSSSegmentedFontFace>(this));
     }
 }
 
+void CSSSegmentedFontFace::accept(Visitor* visitor) const
+{
+    visitor->visit(m_fontFaces);
+    visitor->visit(m_callbacks);
+}
+
 }