[oilpan] Wrap NodeVector into CollectionRoot for ensure that contained nodes stay alive.

Source/core/dom/ContainerNode.cpp

Index: Source/core/dom/ContainerNode.cpp
diff --git a/Source/core/dom/ContainerNode.cpp b/Source/core/dom/ContainerNode.cpp
index 98b89a4b50c34213e16cbfa013f7059a0d82c2fe..609c142f01b4b62f14cc2ed2e92077fe7036df94 100644
--- a/Source/core/dom/ContainerNode.cpp
+++ b/Source/core/dom/ContainerNode.cpp
@@ -76,7 +76,7 @@ unsigned NoEventDispatchAssertion::s_count = 0;
 static void collectChildrenAndRemoveFromOldParent(Node* node, NodeVector& nodes, ExceptionCode& ec)
 {
     if (node->nodeType() != Node::DOCUMENT_FRAGMENT_NODE) {
-        nodes.append(adoptRawResult(node));
+        nodes->append(adoptRawResult(node));
         if (Handle<ContainerNode> oldParent = node->parentNode())
             oldParent->removeChild(adoptRawResult(node), ec);
         return;
@@ -104,7 +104,7 @@ void ContainerNode::takeAllChildrenFrom(const Handle<ContainerNode>& oldParent)
 
     if (oldParent->document()->hasMutationObserversOfType(MutationObserver::ChildList)) {
         ChildListMutationScope mutation(oldParent.raw());
-        for (unsigned i = 0; i < children.size(); ++i) {
+        for (unsigned i = 0; i < children->size(); ++i) {
             HandleScope scope;
             mutation.willRemoveChild(children[i].handle().raw());
         }
@@ -115,7 +115,7 @@ void ContainerNode::takeAllChildrenFrom(const Handle<ContainerNode>& oldParent)
 
     oldParent->removeDetachedChildren();
 
-    for (unsigned i = 0; i < children.size(); ++i) {
+    for (unsigned i = 0; i < children->size(); ++i) {
         HandleScope scope;
         if (children[i]->attached())
             children[i]->detach();
@@ -260,7 +260,7 @@ bool ContainerNode::insertBefore(const Handle<Node>& newChild, const Handle<Node
     collectChildrenAndRemoveFromOldParent(newChild.raw(), targets, ec);
     if (ec)
         return false;
-    if (targets.isEmpty())
+    if (targets->isEmpty())
         return true;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
@@ -270,7 +270,7 @@ bool ContainerNode::insertBefore(const Handle<Node>& newChild, const Handle<Node
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     ChildListMutationScope mutation(this);
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
@@ -400,7 +400,7 @@ bool ContainerNode::replaceChild(const Handle<Node>& newChild, const Handle<Node
     InspectorInstrumentation::willInsertDOMNode(document(), this);
 
     // Add the new child(ren)
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
@@ -451,7 +451,7 @@ static void willRemoveChildren(const Handle<ContainerNode>& container)
     container->document()->nodeChildrenWillBeRemoved(container);
 
     ChildListMutationScope mutation(container.raw());
-    for (NodeVector::const_iterator it = children.begin(); it != children.end(); it++) {
+    for (NodeVector::const_iterator it = children->begin(); it != children->end(); it++) {
         HandleScope scope;
         Node* child = it->handle().raw();
         mutation.willRemoveChild(child);
@@ -599,17 +599,17 @@ void ContainerNode::removeChildren()
         WidgetHierarchyUpdatesSuspensionScope suspendWidgetHierarchyUpdates;
         {
             NoEventDispatchAssertion assertNoEventDispatch;
-            removedChildren.reserveInitialCapacity(childNodeCount());
+            removedChildren->reserveInitialCapacity(childNodeCount());
             while (m_firstChild) {
                 HandleScope scope;
-                removedChildren.append(m_firstChild);
+                removedChildren->append(m_firstChild);
                 removeBetween(nullptr, m_firstChild->nextSibling(), m_firstChild);
             }
         }
 
-        childrenChanged(false, nullptr, nullptr, -static_cast<int>(removedChildren.size()));
+        childrenChanged(false, nullptr, nullptr, -static_cast<int>(removedChildren->size()));
         
-        for (size_t i = 0; i < removedChildren.size(); ++i) {
+        for (size_t i = 0; i < removedChildren->size(); ++i) {
             HandleScope scope;
             ChildNodeRemovalNotifier(selfHandle()).notify(removedChildren[i].handle().raw());
         }
@@ -638,7 +638,7 @@ bool ContainerNode::appendChild(const Handle<Node>& newChild, ExceptionCode& ec,
     if (ec)
         return false;
 
-    if (targets.isEmpty())
+    if (targets->isEmpty())
         return true;
 
     // We need this extra check because collectChildrenAndRemoveFromOldParent() can fire mutation events.
@@ -649,7 +649,7 @@ bool ContainerNode::appendChild(const Handle<Node>& newChild, ExceptionCode& ec,
 
     // Now actually add the child(ren)
     ChildListMutationScope mutation(this);
-    for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
+    for (NodeVector::const_iterator it = targets->begin(); it != targets->end(); ++it) {
         HandleScope scope;
         Handle<Node> child = *it;
 
@@ -881,7 +881,7 @@ void ContainerNode::reportMemoryUsage(MemoryObjectInfo* memoryObjectInfo) const
     // Report child nodes as direct members to make them look like a tree in the snapshot.
     NodeVector children;
     getChildNodes(const_cast<ContainerNode*>(this), children);
-    for (size_t i = 0; i < children.size(); ++i)
+    for (size_t i = 0; i < children->size(); ++i)
         info.addMember(children[i], "child");
 }