[Oilpan]: Move CSSFontSelectorClient to the oilpan heap using transition types.

Source/core/dom/Element.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ skipping 93 matching lines @@
 #include "wtf/text/CString.h"
 #include "wtf/text/StringBuilder.h"
 #include "wtf/text/TextPosition.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 using namespace XMLNames;
 
 class StyleResolverParentPusher {
+    STACK_ALLOCATED();
 public:
     explicit StyleResolverParentPusher(Element& parent)
         : m_parent(parent)
-        , m_pushedStyleResolver(0)
+        , m_pushedStyleResolver(nullptr)
     {
     }
     void push()
     {
         if (m_pushedStyleResolver)
             return;
         m_pushedStyleResolver = &m_parent.document().ensureStyleResolver();
         m_pushedStyleResolver->pushParentElement(m_parent);
     }
     ~StyleResolverParentPusher()
     {
 
         if (!m_pushedStyleResolver)

[haraken, 2014/03/25 13:19:30]

Is it safe to touch m_pushedStyleResolver in a destructor of stack-allocated
objects?

[wibling-chromium, 2014/03/25 13:27:17]

I would think so since the destructor will never be called by the garbage
collector, but only when the object goes out of scope. 
Even if there is a GC done as part of the destructor this stack allocated object
will never die as part of that GC and given that is has a member to the
StyleResolver the resolver will also not die and can be referenced.

             return;
 
         // This tells us that our pushed style selector is in a bad state,
         // so we should just bail out in that scenario.
         ASSERT(m_pushedStyleResolver == m_parent.document().styleResolver());
         if (m_pushedStyleResolver != m_parent.document().styleResolver())
             return;
 
         m_pushedStyleResolver->popParentElement(m_parent);
     }
 
 private:
     Element& m_parent;
-    StyleResolver* m_pushedStyleResolver;
+    RawPtrWillBeMember<StyleResolver> m_pushedStyleResolver;
 };
 
 typedef Vector<RefPtr<Attr> > AttrNodeList;
 typedef HashMap<Element*, OwnPtr<AttrNodeList> > AttrNodeListMap;
 
 static AttrNodeListMap& attrNodeListMap()
 {
     DEFINE_STATIC_LOCAL(AttrNodeListMap, map, ());
     return map;
 }
@@ skipping 3250 matching lines @@
     // Before doing so, we need to resolve issues in HTMLSelectElement::recalcListItems
     // and RenderMenuList::setText. See also https://bugs.webkit.org/show_bug.cgi?id=88405
     if (isHTMLOptionElement(*this) || isHTMLOptGroupElement(*this))
         return false;
     if (FullscreenElementStack::isActiveFullScreenElement(this))
         return false;
     return true;
 }
 
 } // namespace WebCore