Remove the lifetime hack in ImageLoader where it keeps its assoc element alive

third_party/WebKit/Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 129 matching lines @@
     BypassMainWorldBehavior m_shouldBypassMainWorldCSP;
     UpdateFromElementBehavior m_updateBehavior;
     RefPtr<ScriptState> m_scriptState;
     WeakPtrFactory<Task> m_weakFactory;
     ReferrerPolicy m_referrerPolicy;
     KURL m_requestURL;
 };
 
 ImageLoader::ImageLoader(Element* element)
     : m_element(element)
-    , m_derefElementTimer(this, &ImageLoader::timerFired)
     , m_hasPendingLoadEvent(false)
     , m_hasPendingErrorEvent(false)
     , m_imageComplete(true)
     , m_loadingImageDocument(false)
-    , m_elementIsProtected(false)
     , m_suppressErrorEvents(false)
 {
     RESOURCE_LOADING_DVLOG(1) << "new ImageLoader " << this;
     ThreadState::current()->registerPreFinalizer(this);
 }
 
 ImageLoader::~ImageLoader()
 {
 }
 
@@ skipping 11 matching lines @@
 
 DEFINE_TRACE(ImageLoader)
 {
     visitor->trace(m_image);
     visitor->trace(m_element);
 }
 
 void ImageLoader::setImage(ImageResource* newImage)
 {
     setImageWithoutConsideringPendingLoadEvent(newImage);
-
-    // Only consider updating the protection ref-count of the Element immediately before returning
-    // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingEvent();
 }
 
 void ImageLoader::setImageWithoutConsideringPendingLoadEvent(ImageResource* newImage)
 {
     ASSERT(m_failedLoadURL.isEmpty());
     ImageResource* oldImage = m_image.get();
     if (newImage != oldImage) {
         m_image = newImage;
         if (m_hasPendingLoadEvent) {
             loadEventSender().cancelEvent(this);
@@ skipping 135 matching lines @@
         if (newImage) {
             newImage->addObserver(this);
         }
         if (oldImage) {
             oldImage->removeObserver(this);
         }
     }
 
     if (LayoutImageResource* imageResource = layoutImageResource())
         imageResource->resetAnimation();
-
-    // Only consider updating the protection ref-count of the Element immediately before returning
-    // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingEvent();
 }
 
 void ImageLoader::updateFromElement(UpdateFromElementBehavior updateBehavior, ReferrerPolicy referrerPolicy)
 {
     AtomicString imageSourceURL = m_element->imageSourceURL();
     m_suppressErrorEvents = (updateBehavior == UpdateSizeChanged);
 
     if (updateBehavior == UpdateIgnorePreviousError)
         clearFailedLoadURL();
 
@@ skipping 99 matching lines @@
         m_hasPendingLoadEvent = false;
 
         if (resource->resourceError().isAccessCheck())
             crossSiteOrCSPViolationOccurred(AtomicString(resource->resourceError().failingURL()));
 
         // The error event should not fire if the image data update is a result of environment change.
         // https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element:the-img-element-55
         if (!m_suppressErrorEvents)
             dispatchErrorEvent();
 
-        // Only consider updating the protection ref-count of the Element immediately before returning
-        // from this function as doing so might result in the destruction of this ImageLoader.
-        updatedHasPendingEvent();
         return;
     }
     if (resource->wasCanceled()) {
         m_hasPendingLoadEvent = false;
-        // Only consider updating the protection ref-count of the Element immediately before returning
-        // from this function as doing so might result in the destruction of this ImageLoader.
-        updatedHasPendingEvent();
         return;
     }
     loadEventSender().dispatchEventSoon(this);
 }
 
 LayoutImageResource* ImageLoader::layoutImageResource()
 {
     LayoutObject* layoutObject = m_element->layoutObject();
 
     if (!layoutObject)
@@ skipping 21 matching lines @@
         return;
 
     // Only update the layoutObject if it doesn't have an image or if what we have
     // is a complete image.  This prevents flickering in the case where a dynamic
     // change is happening between two images.
     ImageResource* cachedImage = imageResource->cachedImage();
     if (m_image != cachedImage && (m_imageComplete || !cachedImage))
         imageResource->setImageResource(m_image.get());
 }
 
-void ImageLoader::updatedHasPendingEvent()
-{
-    // If an Element that does image loading is removed from the DOM the load/error event for the image is still observable.
-    // As long as the ImageLoader is actively loading, the Element itself needs to be ref'ed to keep it from being
-    // destroyed by DOM manipulation or garbage collection.
-    // If such an Element wishes for the load to stop when removed from the DOM it needs to stop the ImageLoader explicitly.
-    bool wasProtected = m_elementIsProtected;
-    m_elementIsProtected = m_hasPendingLoadEvent || m_hasPendingErrorEvent;
-    if (wasProtected == m_elementIsProtected)
-        return;
-
-    if (m_elementIsProtected) {
-        if (m_derefElementTimer.isActive())
-            m_derefElementTimer.stop();
-        else
-            m_keepAlive = m_element;
-    } else {
-        ASSERT(!m_derefElementTimer.isActive());
-        m_derefElementTimer.startOneShot(0, BLINK_FROM_HERE);
-    }
-}
-
-void ImageLoader::timerFired(TimerBase*)
-{
-    m_keepAlive.clear();
-}
-
 void ImageLoader::dispatchPendingEvent(ImageEventSender* eventSender)
 {
     RESOURCE_LOADING_DVLOG(1) << "ImageLoader::dispatchPendingEvent " << this;
     ASSERT(eventSender == &loadEventSender() || eventSender == &errorEventSender());
     const AtomicString& eventType = eventSender->eventType();
     if (eventType == EventTypeNames::load)
         dispatchPendingLoadEvent();
     if (eventType == EventTypeNames::error)
         dispatchPendingErrorEvent();
 }
 
 void ImageLoader::dispatchPendingLoadEvent()
 {
     if (!m_hasPendingLoadEvent)
         return;
     if (!m_image)
         return;
     m_hasPendingLoadEvent = false;
     if (element()->document().frame())
         dispatchLoadEvent();
-
-    // Only consider updating the protection ref-count of the Element immediately before returning
-    // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingEvent();
 }
 
 void ImageLoader::dispatchPendingErrorEvent()
 {
     if (!m_hasPendingErrorEvent)
         return;
     m_hasPendingErrorEvent = false;
 
     if (element()->document().frame())
         element()->dispatchEvent(Event::create(EventTypeNames::error));
-
-    // Only consider updating the protection ref-count of the Element immediately before returning
-    // from this function as doing so might result in the destruction of this ImageLoader.
-    updatedHasPendingEvent();
 }
 
 bool ImageLoader::getImageAnimationPolicy(ImageAnimationPolicy& policy)
 {
     if (!element()->document().settings())
         return false;
 
     policy = element()->document().settings()->imageAnimationPolicy();
     return true;
 }
@@ skipping 10 matching lines @@
 
 void ImageLoader::elementDidMoveToNewDocument()
 {
     if (m_loadDelayCounter)
         m_loadDelayCounter->documentChanged(m_element->document());
     clearFailedLoadURL();
     setImage(0);
 }
 
 } // namespace blink