[oilpan] Wrap NodeVector into CollectionRoot for ensure that contained nodes stay alive.

Source/core/dom/ContainerNode.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 58 matching lines @@
 
 ChildNodesLazySnapshot* ChildNodesLazySnapshot::latestSnapshot = 0;
 
 #ifndef NDEBUG
 unsigned NoEventDispatchAssertion::s_count = 0;
 #endif
 
 static void collectChildrenAndRemoveFromOldParent(Node* node, NodeVector& nodes, ExceptionCode& ec)
 {
     if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
-        nodes.append(adoptRawResult(node));
+        nodes->append(adoptRawResult(node));
         if (Handle<ContainerNode> oldParent = node->parentNode())
             oldParent->removeChild(adoptRawResult(node), ec);
         return;
     }
     getChildNodes(node, nodes);
     toContainerNode(node)->removeChildren();
 }
 
 void ContainerNode::removeDetachedChildren()
 {
     if (connectedSubframeCount()) {
         for (Handle<Node> child = firstChild(); child; child = child->nextSibling()) {
             HandleScope scope;
             child->updateAncestorConnectedSubframeCountForRemoval();
         }
     }
     // FIXME: We should be able to ASSERT(!attached()) here: https://bugs.webkit.org/show_bug.cgi?id=107801
     removeDetachedChildrenInContainer<Node, ContainerNode>(this);
 }
 
 void ContainerNode::takeAllChildrenFrom(const Handle<ContainerNode>& oldParent)
 {
     NodeVector children;
     getChildNodes(oldParent.raw(), children);
 
     if (oldParent->document()->hasMutationObserversOfType(MutationObserver::ChildList)) {
         ChildListMutationScope mutation(oldParent.raw());
-        for (unsigned i = 0; i < children.size(); ++i) {
+        for (unsigned i = 0; i < children->size(); ++i) {
             HandleScope scope;
             mutation.willRemoveChild(children[i].handle().raw());
         }
     }
 
     // FIXME: We need to do notifyMutationObserversNodeWillDetach() for each child,
     // probably inside removeDetachedChildrenInContainer.
 
     oldParent->removeDetachedChildren();
 
-    for (unsigned i = 0; i < children.size(); ++i) {
+    for (unsigned i = 0; i < children->size(); ++i) {
         HandleScope scope;
         if (children[i]->attached())
             children[i]->detach();
         // FIXME: We need a no mutation event version of adoptNode.
         RefPtr<Node> child = document()->adoptNode(children[i].handle().raw(), ASSERT_NO_EXCEPTION);
         parserAppendChild(child.get());
         // FIXME: Together with adoptNode above, the tree scope might get updated recursively twice
         // (if the document changed or oldParent was in a shadow tree, AND *this is in a shadow tree).
         // Can we do better?
         treeScope()->adoptIfNeeded(child.get());
@@ skipping 124 matching lines @@
 
     if (refChild->previousSibling() == newChild || refChild == newChild) // nothing to do
         return true;
 
     Handle<Node> next = refChild;
 
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(newChild.raw(), targets, ec);
     if (ec)
         return false;
-    if (targets.isEmpty())
+    if (targets->isEmpty())
         return true;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
     if (!checkAcceptChildGuaranteedNodeTypes(selfHandle(), newChild.raw(), ec))
         return false;
 
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     ChildListMutationScope mutation(this);
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "next" is no longer a child of "this".
         // It's also possible that "child" has been inserted elsewhere.
         // In either of those cases, we'll just stop.
         if (next->parentNode() != this)
             break;
         if (child->parentNode())
@@ skipping 109 matching lines @@
     if (ec)
         return false;
 
     // Does this yet another check because collectChildrenAndRemoveFromOldParent() fires a MutationEvent.
     if (!checkReplaceChild(selfHandle(), newChild.raw(), oldChild.raw(), ec))
         return false;
 
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     // Add the new child(ren)
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "next" is no longer a child of "this".
         // It's also possible that "child" has been inserted elsewhere.
         // In either of those cases, we'll just stop.
         if (next && next->parentNode() != this)
             break;
         if (child->parentNode())
@@ skipping 30 matching lines @@
 
 static void willRemoveChildren(const Handle<ContainerNode>& container)
 {
     HandleScope scope;
     NodeVector children;
     getChildNodes(container.raw(), children);
 
     container->document()->nodeChildrenWillBeRemoved(container);
 
     ChildListMutationScope mutation(container.raw());
-    for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
+    for (NodeVector::const_iterator it = children->begin(); it != children->end(); it++) {
         HandleScope scope;
         Node* child = it->handle().raw();
         mutation.willRemoveChild(child);
         child->notifyMutationObserversNodeWillDetach();
 
         // fire removed from document mutation events.
         dispatchChildRemovalEvents(child);
     }
 
     ChildFrameDisconnector(container).disconnect(ChildFrameDisconnector::DescendantsOnly);
@@ skipping 127 matching lines @@
 
     // Do any prep work needed before actually starting to detach
     // and remove... e.g. stop loading frames, fire unload events.
     willRemoveChildren(protect);
 
     NodeVector removedChildren;
     {
         WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
         {
             NoEventDispatchAssertion assertNoEventDispatch;
-            removedChildren.reserveInitialCapacity(childNodeCount());
+            removedChildren->reserveInitialCapacity(childNodeCount());
             while (m_firstChild) {
                 HandleScope scope;
-                removedChildren.append(m_firstChild);
+                removedChildren->append(m_firstChild);
                 removeBetween(nullptr, m_firstChild->nextSibling(), m_firstChild);
             }
         }
 
-        childrenChanged(false, nullptr, nullptr, -static_cast<int>(removedChildren.size()));
+        childrenChanged(false, nullptr, nullptr, -static_cast<int>(removedChildren->size()));
         
-        for (size_t i = 0; i < removedChildren.size(); ++i) {
+        for (size_t i = 0; i < removedChildren->size(); ++i) {
             HandleScope scope;
             ChildNodeRemovalNotifier(selfHandle()).notify(removedChildren[i].handle().raw());
         }
     }
 
     dispatchSubtreeModifiedEvent();
 }
 
 bool ContainerNode::appendChild(const Handle<Node>& newChild, ExceptionCode& ec, AttachBehavior attachBehavior)
 {
     HandleScope scope;
     // FIXME(oilpan): not needed when all Node pointers are handlified.
     Handle<ContainerNode> protect(this);
 
     ec = 0;
 
     // Make sure adding the new child is ok
     if (!checkAddChild(selfHandle(), newChild.raw(), ec))
         return false;
 
     if (newChild == m_lastChild) // nothing to do
         return newChild;
 
     NodeVector targets;
     collectChildrenAndRemoveFromOldParent(newChild.raw(), targets, ec);
     if (ec)
         return false;
 
-    if (targets.isEmpty())
+    if (targets->isEmpty())
         return true;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
     if (!checkAcceptChildGuaranteedNodeTypes(selfHandle(), newChild.raw(), ec))
         return false;
 
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     // Now actually add the child(ren)
     ChildListMutationScope mutation(this);
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
         // If the child has a parent again, just stop what we're doing, because
         // that means someone is doing something with DOM mutation -- can't re-parent
         // a child that already has a parent.
         if (child->parentNode())
             break;
 
         treeScope()->adoptIfNeeded(child.raw());
@@ skipping 211 matching lines @@
 void ContainerNode::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
 {
     MemoryClassInfo info(memoryObjectInfo, this, WebCoreMemoryTypes::DOM);
     Node::reportMemoryUsage(memoryObjectInfo);
     info.ignoreMember(m_firstChild);
     info.ignoreMember(m_lastChild);
 
     // Report child nodes as direct members to make them look like a tree in the snapshot.
     NodeVector children;
     getChildNodes(const_cast<ContainerNode*>(this), children);
-    for (size_t i = 0; i < children.size(); ++i)
+    for (size_t i = 0; i < children->size(); ++i)
         info.addMember(children[i], "child");
 }
 
 static void dispatchChildInsertionEvents(Node* child)
 {
     if (child->isInShadowTree())
         return;
 
     ASSERT(!NoEventDispatchAssertion::isEventDispatchForbidden());
 
@@ skipping 76 matching lines @@
 #endif
 
 void ContainerNode::accept(Visitor* visitor) const
 {
     Node::accept(visitor);
     visitor->visit(m_firstChild);
     visitor->visit(m_lastChild);
 }
 
 } // namespace WebCore