[oilpan] Move CSSFontFace and CSSSegmentedFontFace to the managed heap

Source/core/css/CSSSegmentedFontFace.h

Index: Source/core/css/CSSSegmentedFontFace.h
diff --git a/Source/core/css/CSSSegmentedFontFace.h b/Source/core/css/CSSSegmentedFontFace.h
index 6507d1763228f16a75b04eb1a8e93f6df624c66b..61979172a7e96bd5216b8abcc48dd695d87d1600 100644
--- a/Source/core/css/CSSSegmentedFontFace.h
+++ b/Source/core/css/CSSSegmentedFontFace.h
@@ -26,9 +26,9 @@
 #ifndef CSSSegmentedFontFace_h
 #define CSSSegmentedFontFace_h
 
+#include "heap/Handle.h"
 #include <wtf/HashMap.h>
 #include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
 
@@ -40,28 +40,33 @@ class FontData;
 class FontDescription;
 class SegmentedFontData;
 
-class CSSSegmentedFontFace : public RefCounted<CSSSegmentedFontFace> {
+class CSSSegmentedFontFace : public HeapAllocatedFinalized<CSSSegmentedFontFace> {
+    DECLARE_GC_TYPE_MARKER
 public:
-    static PassRefPtr<CSSSegmentedFontFace> create(CSSFontSelector* selector) { return adoptRef(new CSSSegmentedFontFace(selector)); }
+    static Result<CSSSegmentedFontFace> create(CSSFontSelector* selector) { return adopt(new CSSSegmentedFontFace(selector)); }
     ~CSSSegmentedFontFace();
 
-    CSSFontSelector* fontSelector() const { return m_fontSelector; }
+    CSSFontSelector* fontSelector() const { return m_fontSelector.get(); }
 
-    void fontLoaded(CSSFontFace*);
+    void fontLoaded(Handle<CSSFontFace>);
 
-    void appendFontFace(PassRefPtr<CSSFontFace>);
+    void appendFontFace(Handle<CSSFontFace>);
 
     PassRefPtr<FontData> getFontData(const FontDescription&);
 
-    class LoadFontCallback : public RefCounted<LoadFontCallback> {
+    class LoadFontCallback : public HeapAllocatedFinalized<LoadFontCallback> {
+        DECLARE_GC_TYPE_MARKER
     public:
         virtual ~LoadFontCallback() { }
-        virtual void notifyLoaded(CSSSegmentedFontFace*) = 0;
-        virtual void notifyError(CSSSegmentedFontFace*) = 0;
+        virtual void notifyLoaded(Handle<CSSSegmentedFontFace>) = 0;
+        virtual void notifyError(Handle<CSSSegmentedFontFace>) = 0;
+        virtual void accept(Visitor*) const = 0;
     };
 
     bool checkFont() const;
-    void loadFont(const FontDescription&, PassRefPtr<LoadFontCallback> loadCallback);
+    void loadFont(const FontDescription&, Handle<LoadFontCallback> loadCallback);
+
+    void accept(Visitor*) const;
 
 private:
     CSSSegmentedFontFace(CSSFontSelector*);
@@ -70,10 +75,10 @@ private:
     bool isValid() const;
     bool isLoading() const;
 
-    CSSFontSelector* m_fontSelector;
+    RefPtr<CSSFontSelector> m_fontSelector;

[haraken, 2013/07/04 08:03:44]

Adding this RefPtr fixed the heap corruption in SVG tests. Given that
CSSSegmentedFontFace is responsible for keeping the lifetime of CSSFontSelector,
I think this should be a RefPtr.

My question is why the previous code had been working without the RefPtr... If
you think it's OK to land with the RefPtr, I'll land this CL. If you're
skeptical about the RefPtr, I'll look into why the previous code had been
working without the RefPtr.

     HashMap<unsigned, RefPtr<SegmentedFontData> > m_fontDataTable;
-    Vector<RefPtr<CSSFontFace>, 1> m_fontFaces;
-    Vector<RefPtr<LoadFontCallback> > m_callbacks;
+    Vector<Member<CSSFontFace>, 1> m_fontFaces;
+    Vector<Member<LoadFontCallback> > m_callbacks;
 };
 
 } // namespace WebCore