Oilpan: Delay frameDetached() so it won't dispatch event inside ~SVGImage

Source/core/svg/graphics/SVGImage.cpp

 /*
  * Copyright (C) 2006 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) Research In Motion Limited 2011. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
@@ skipping 39 matching lines @@
 #include "platform/graphics/ImageObserver.h"
 #include "wtf/PassRefPtr.h"
 
 namespace WebCore {
 
 SVGImage::SVGImage(ImageObserver* observer)
     : Image(observer)
 {
 }
 
+// Delay destruction of Page attached to SVGImage.
+// We need to call |loader().frameDetached()| before disposing a Page, however
+// the call is non-trivial and involves touching/creating on-heap objects
+// which is not possible from a GarbageCollected object finalizer.
+// To circumvent this, DelayedSVGImageDestructor will delay the call to
+// the end of current event loop.
+class DelayedSVGImageDestructor {
+public:
+    void add(PassOwnPtr<SVGImageChromeClient> chromeClient, PassOwnPtr<Page> page)
+    {
+        Entry entry;
+        entry.chromeClient = chromeClient.leakPtr();

[eseidel, 2014/03/10 21:49:09]

Why not just use an OwnPtr and then call .clear() later instead of this manual
delete?

+        entry.page = page.leakPtr();
+
+        m_entries.append(entry);
+        m_detachTimer.startOneShot(0.0);
+    }
+
+    static DelayedSVGImageDestructor* get()
+    {
+        DEFINE_STATIC_LOCAL(DelayedSVGImageDestructor, delayed, ());
+        return &delayed;
+    }
+
+private:
+    DelayedSVGImageDestructor()
+        : m_detachTimer(this, &DelayedSVGImageDestructor::detachTimerFired)
+    {
+    }
+
+    void detachTimerFired(Timer<DelayedSVGImageDestructor>*)
+    {
+        Vector<Entry>::const_iterator it = m_entries.begin();
+        Vector<Entry>::const_iterator itEnd = m_entries.end();
+        for (; it != itEnd; ++it) {
+            it->page->mainFrame()->loader().frameDetached();
+            delete it->page;
+            delete it->chromeClient;
+        }
+
+        m_entries.clear();
+    }
+
+    struct Entry {
+        SVGImageChromeClient* chromeClient;
+        Page* page;
+    };
+    Vector<Entry> m_entries;
+    Timer<DelayedSVGImageDestructor> m_detachTimer;
+};
+
 SVGImage::~SVGImage()
 {
-    if (m_page) {
-        // Store m_page in a local variable, clearing m_page, so that SVGImageChromeClient knows we're destructed.
-        OwnPtr<Page> currentPage = m_page.release();
-        currentPage->mainFrame()->loader().frameDetached(); // Break both the loader and view references to the frame
-    }
-
-    // Verify that page teardown destroyed the Chrome
-    ASSERT(!m_chromeClient || !m_chromeClient->image());
+    m_chromeClient->clearImage();
+    DelayedSVGImageDestructor::get()->add(m_chromeClient.release(), m_page.release());
 }
 
 bool SVGImage::isInSVGImage(const Element* element)
 {
     ASSERT(element);
 
     Page* page = element->document().page();
     if (!page)
         return false;
 
@@ skipping 335 matching lines @@
 
     return m_page;
 }
 
 String SVGImage::filenameExtension() const
 {
     return "svg";
 }
 
 }