Move StyleSheet to the oilpan heap using transition types.

Source/core/css/StyleSheetContents.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2006, 2007, 2012 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
@@ skipping 356 matching lines @@
     return false;
 }
 
 bool StyleSheetContents::loadCompleted() const
 {
     StyleSheetContents* parentSheet = parentStyleSheet();
     if (parentSheet)
         return parentSheet->loadCompleted();
 
     StyleSheetContents* root = rootStyleSheet();
-    for (unsigned i = 0; i < root->m_clients.size(); ++i) {
-        if (!root->m_clients[i]->loadCompleted())
+    for (ClientsIterator it = root->m_clients.begin(); it != root->m_clients.end(); ++it) {
+        if (!(*it)->loadCompleted())
             return false;
     }
     return true;
 }
 
 void StyleSheetContents::checkLoaded()
 {
     if (isLoading())
         return;
 
     // Avoid |this| being deleted by scripts that run via
     // ScriptableDocumentParser::executeScriptsWaitingForResources().
     // See https://bugs.webkit.org/show_bug.cgi?id=95106
     RefPtrWillBeRawPtr<StyleSheetContents> protect(this);
 
     StyleSheetContents* parentSheet = parentStyleSheet();
     if (parentSheet) {
         parentSheet->checkLoaded();
         return;
     }
 
     StyleSheetContents* root = rootStyleSheet();
     if (root->m_clients.isEmpty())
         return;
 
-    Vector<CSSStyleSheet*> clients(root->m_clients);
-    for (unsigned i = 0; i < clients.size(); ++i) {
-        // Avoid |CSSSStyleSheet| and |ownerNode| being deleted by scripts that run via
-        // ScriptableDocumentParser::executeScriptsWaitingForResources().
-        RefPtr<CSSStyleSheet> protectClient(clients[i]);
+    // Avoid |CSSSStyleSheet| and |ownerNode| being deleted by scripts that run via
+    // ScriptableDocumentParser::executeScriptsWaitingForResources(). Also protect

[haraken, 2014/03/05 14:21:22]

FYI, I'm planning to make a change that moves
ScriptableDocumentParser::executeScriptsWaitingForResources() to the next event
loop (to fix another protection bug). It will enable us to remove the
protection.

[Mads Ager (chromium), 2014/03/05 14:51:16]

The protection here is not only because of executeScriptsWaitingForResources. It
is also because the protectedClients[i]->sheetLoaded() call on line 422 can lead
to CSSStyleSheets reaching ref count zero. That was the problem when I landed
this change the first time.

+    // the |CSSStyleSheet| from being deleted during iteration via the |sheetLoaded|
+    // method.
+    //
+    // FIXME: oilpan: with oilpan we do not need to protect the CSSStyleSheets
+    // explicitly during the iteration. The iterator will make the pointers
+    // strong during iteration so we can just directly iterate root->m_clients.
+    WillBeHeapVector<RefPtrWillBeMember<CSSStyleSheet>, 5> protectedClients;
+    for (ClientsIterator it = root->m_clients.begin(); it != root->m_clients.end(); ++it)
+        protectedClients.append(*it);
 
-        if (clients[i]->loadCompleted())
+    for (unsigned i = 0; i < protectedClients.size(); ++i) {
+        if (protectedClients[i]->loadCompleted())
             continue;
 
         // sheetLoaded might be invoked after its owner node is removed from document.
-        if (RefPtr<Node> ownerNode = clients[i]->ownerNode()) {
-            if (clients[i]->sheetLoaded())
+        if (RefPtr<Node> ownerNode = protectedClients[i]->ownerNode()) {
+            if (protectedClients[i]->sheetLoaded())
                 ownerNode->notifyLoadedSheetAndAllCriticalSubresources(m_didLoadErrorOccur);
         }
     }
 }
 
 void StyleSheetContents::notifyLoadedSheet(const CSSStyleSheetResource* sheet)
 {
     ASSERT(sheet);
     m_didLoadErrorOccur |= sheet->errorOccurred();
     // updateLayoutIgnorePendingStyleSheets can cause us to create the RuleSet on this
     // sheet before its imports have loaded. So clear the RuleSet when the imports
     // load since the import's subrules are flattened into its parent sheet's RuleSet.
     clearRuleSet();
 }
 
 void StyleSheetContents::startLoadingDynamicSheet()
 {
     StyleSheetContents* root = rootStyleSheet();
-    for (unsigned i = 0; i < root->m_clients.size(); ++i)
-        root->m_clients[i]->startLoadingDynamicSheet();
+    for (ClientsIterator it = root->m_clients.begin(); it != root->m_clients.end(); ++it)
+        (*it)->startLoadingDynamicSheet();
 }
 
 StyleSheetContents* StyleSheetContents::rootStyleSheet() const
 {
     const StyleSheetContents* root = this;
     while (root->parentStyleSheet())
         root = root->parentStyleSheet();
     return const_cast<StyleSheetContents*>(root);
 }
 
 bool StyleSheetContents::hasSingleOwnerNode() const
 {
     StyleSheetContents* root = rootStyleSheet();
     if (root->m_clients.isEmpty())
         return false;
     return root->m_clients.size() == 1;
 }
 
 Node* StyleSheetContents::singleOwnerNode() const
 {
     StyleSheetContents* root = rootStyleSheet();
     if (root->m_clients.isEmpty())
         return 0;
     ASSERT(root->m_clients.size() == 1);
-    return root->m_clients[0]->ownerNode();
+    return (*root->m_clients.begin())->ownerNode();
 }
 
 Document* StyleSheetContents::singleOwnerDocument() const
 {
     Node* ownerNode = singleOwnerNode();
     return ownerNode ? &ownerNode->document() : 0;
 }
 
 KURL StyleSheetContents::completeURL(const String& url) const
 {
@@ skipping 41 matching lines @@
 }
 
 StyleSheetContents* StyleSheetContents::parentStyleSheet() const
 {
     return m_ownerRule ? m_ownerRule->parentStyleSheet() : 0;
 }
 
 void StyleSheetContents::registerClient(CSSStyleSheet* sheet)
 {
     ASSERT(!m_clients.contains(sheet));
-    m_clients.append(sheet);
+    m_clients.add(sheet);
 }
 
 void StyleSheetContents::unregisterClient(CSSStyleSheet* sheet)
 {
-    size_t position = m_clients.find(sheet);
-    ASSERT(position != kNotFound);
-    m_clients.remove(position);
+    ASSERT(m_clients.contains(sheet));
+    m_clients.remove(sheet);
 }
 
 void StyleSheetContents::addedToMemoryCache()
 {
     ASSERT(!m_isInMemoryCache);
     ASSERT(isCacheable());
     m_isInMemoryCache = true;
 }
 
 void StyleSheetContents::removedFromMemoryCache()
@@ skipping 24 matching lines @@
         parentSheet->clearRuleSet();
 
     // Don't want to clear the StyleResolver if the RuleSet hasn't been created
     // since we only clear the StyleResolver so that it's members are properly
     // updated in ScopedStyleResolver::addRulesFromSheet.
     if (!m_ruleSet)
         return;
 
     // Clearing the ruleSet means we need to recreate the styleResolver data structures.
     // See the StyleResolver calls in ScopedStyleResolver::addRulesFromSheet.
-    for (size_t i = 0; i < m_clients.size(); ++i) {
-        if (Document* document = m_clients[i]->ownerDocument())
+    for (ClientsIterator it = m_clients.begin(); it != m_clients.end(); ++it) {
+        if (Document* document = (*it)->ownerDocument())
             document->styleEngine()->clearResolver();
     }
     m_ruleSet.clear();
 }
 
 void StyleSheetContents::notifyRemoveFontFaceRule(const StyleRuleFontFace* fontFaceRule)
 {
     StyleSheetContents* root = rootStyleSheet();
 
-    for (unsigned i = 0; i < root->m_clients.size(); ++i) {
-        if (Node* ownerNode = root->m_clients[0]->ownerNode())
+    for (ClientsIterator it = root->m_clients.begin(); it != root->m_clients.end(); ++it) {
+        if (Node* ownerNode = (*it)->ownerNode())
             ownerNode->document().styleEngine()->removeFontFaceRules(WillBeHeapVector<RawPtrWillBeMember<const StyleRuleFontFace> >(1, fontFaceRule));
     }
 }
 
 static void findFontFaceRulesFromRules(const WillBeHeapVector<RefPtrWillBeMember<StyleRuleBase> >& rules, WillBeHeapVector<RawPtrWillBeMember<const StyleRuleFontFace> >& fontFaceRules)
 {
     for (unsigned i = 0; i < rules.size(); ++i) {
         StyleRuleBase* rule = rules[i].get();
 
         if (rule->isFontFaceRule()) {
@@ skipping 16 matching lines @@
     }
 
     findFontFaceRulesFromRules(childRules(), fontFaceRules);
 }
 
 void StyleSheetContents::trace(Visitor* visitor)
 {
     visitor->trace(m_ownerRule);
     visitor->trace(m_importRules);
     visitor->trace(m_childRules);
+    visitor->trace(m_clients);
 }
 
 }