Oilpan: Remove guardRef and guardDeref from TreeScope.

Source/core/dom/Document.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
@@ skipping 197 matching lines @@
     PluginDocumentClass = 1 << 3,
     MediaDocumentClass = 1 << 4,
     SVGDocumentClass = 1 << 5,
     XMLDocumentClass = 1 << 6,
 };
 
 typedef unsigned char DocumentClassFlags;
 
 class Document;
 
-class DocumentVisibilityObserver {
+class DocumentVisibilityObserver : public WillBeGarbageCollectedMixin {
 public:
     DocumentVisibilityObserver(Document&);
     virtual ~DocumentVisibilityObserver();
 
     virtual void didChangeVisibilityState(PageVisibilityState) = 0;
 
     // Classes that inherit Node and DocumentVisibilityObserver must have a
     // virtual override of Node::didMoveToNewDocument that calls
     // DocumentVisibilityObserver::setDocument
     void setObservedDocument(Document&);
@@ skipping 623 matching lines @@
 
     Vector<IconURL> iconURLs(int iconTypesMask);
 
     void setUseSecureKeyboardEntryWhenActive(bool);
     bool useSecureKeyboardEntryWhenActive() const;
 
     void updateFocusAppearanceSoon(bool restorePreviousSelection);
     void cancelFocusAppearanceUpdate();
 
     // Extension for manipulating canvas drawing contexts for use in CSS
-    void getCSSCanvasContext(const String& type, const String& name, int width, int height, bool&, RefPtr<CanvasRenderingContext2D>&, bool&, RefPtr<WebGLRenderingContext>&);
+    void getCSSCanvasContext(const String& type, const String& name, int width, int height, bool&, RefPtrWillBeRawPtr<CanvasRenderingContext2D>&, bool&, RefPtrWillBeRawPtr<WebGLRenderingContext>&);
     HTMLCanvasElement& getCSSCanvasElement(const String& name);
 
     bool isDNSPrefetchEnabled() const { return m_isDNSPrefetchEnabled; }
     void parseDNSPrefetchControlHeader(const String&);
 
     // FIXME(crbug.com/305497): This should be removed once DOMWindow is an ExecutionContext.
     virtual void postTask(PassOwnPtr<ExecutionContextTask>) OVERRIDE; // Executes the task on context's thread asynchronously.
 
     virtual void tasksWereSuspended() OVERRIDE FINAL;
     virtual void tasksWereResumed() OVERRIDE FINAL;
@@ skipping 61 matching lines @@
 
     bool hasFullscreenElementStack() const { return m_hasFullscreenElementStack; }
     void setHasFullscreenElementStack() { m_hasFullscreenElementStack = true; }
 
     void webkitExitPointerLock();
     Element* webkitPointerLockElement() const;
 
     // Used to allow element that loads data without going through a FrameLoader to delay the 'load' event.
     void incrementLoadEventDelayCount() { ++m_loadEventDelayCount; }
     void decrementLoadEventDelayCount();
-    bool isDelayingLoadEvent() const { return m_loadEventDelayCount; }
+    void checkLoadEventSoon();
+    bool isDelayingLoadEvent();
     void loadPluginsSoon();
 
     PassRefPtrWillBeRawPtr<Touch> createTouch(DOMWindow*, EventTarget*, int identifier, int pageX, int pageY, int screenX, int screenY, int radiusX, int radiusY, float rotationAngle, float force) const;
     PassRefPtrWillBeRawPtr<TouchList> createTouchList(WillBeHeapVector<RefPtrWillBeMember<Touch> >&) const;
 
     const DocumentTiming& timing() const { return m_documentTiming; }
 
     int requestAnimationFrame(PassOwnPtr<RequestAnimationFrameCallback>);
     void cancelAnimationFrame(int id);
     void serviceScriptedAnimations(double monotonicAnimationStartTime);
@@ skipping 148 matching lines @@
     bool dirtyElementsForLayerUpdate();
     void updateDistributionIfNeeded();
     void updateUseShadowTreesIfNeeded();
     void evaluateMediaQueryListIfNeeded();
 
     void updateRenderTree(StyleRecalcChange);
     void updateStyle(StyleRecalcChange);
 
     void detachParser();
 
+    void clearWeakMembers(Visitor*);
+
     virtual bool isDocument() const OVERRIDE FINAL { return true; }
 
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0) OVERRIDE;
 
     virtual String nodeName() const OVERRIDE FINAL;
     virtual NodeType nodeType() const OVERRIDE FINAL;
     virtual bool childTypeAllowed(NodeType) const OVERRIDE FINAL;
     virtual PassRefPtr<Node> cloneNode(bool deep = true) OVERRIDE FINAL;
     void cloneDataFromDocument(const Document&);
 
@@ skipping 105 matching lines @@
     static uint64_t s_globalTreeVersion;
 
     HashSet<NodeIterator*> m_nodeIterators;
     HashSet<Range*> m_ranges;
 
     unsigned short m_listenerTypes;
 
     MutationObserverOptions m_mutationObserverTypes;
 
     OwnPtrWillBePersistent<StyleEngine> m_styleEngine;
-    RefPtrWillBePersistent<StyleSheetList> m_styleSheetList;
+    RefPtrWillBeMember<StyleSheetList> m_styleSheetList;
 
     OwnPtr<FormController> m_formController;
 
     TextLinkColors m_textLinkColors;
     const OwnPtr<VisitedLinkState> m_visitedLinkState;
 
     bool m_visuallyOrdered;
     ReadyState m_readyState;
     bool m_isParsing;
 
@@ skipping 10 matching lines @@
     String m_title;
     String m_rawTitle;
     bool m_titleSetExplicitly;
     RefPtr<Element> m_titleElement;
 
     OwnPtr<AXObjectCache> m_axObjectCache;
     OwnPtr<DocumentMarkerController> m_markers;
 
     Timer<Document> m_updateFocusAppearanceTimer;
 
     Element* m_cssTarget;

[haraken, 2014/04/25 05:21:42]

Just to confirm:

- Until we remove the TreeShared algorithm, it is safe to have a raw pointer
from a Node X to other Nodes that are in the subtree of X. It is safe to touch
the raw pointer in X's destructor.

- However, it is not safe to have a raw pointer from a Node X to other Nodes
that are not in the subtree of X. It is not safe to touch the raw pointer in X's
destructor.

- Because m_cssTarget is in the subtree of this Document, the raw pointer for
m_cssTarget is safe.

Am I understanding correctly?

[Mads Ager (chromium), 2014/04/25 10:58:25]

Yes, that is correct. If this is safe without Oilpan it is safe now. When we
move away from the TreeShared algorithm, we need to update these raw pointers to
members and trace them.

 
     LoadEventProgress m_loadEventProgress;
 
     double m_startTime;
 
     OwnPtr<ScriptRunner> m_scriptRunner;
 
     Vector<RefPtr<HTMLScriptElement> > m_currentScriptStack;
 
     OwnPtr<TransformSource> m_transformSource;
@@ skipping 79 matching lines @@
 
     typedef HashMap<AtomicString, OwnPtr<Locale> > LocaleIdentifierToLocaleMap;
     LocaleIdentifierToLocaleMap m_localeCache;
 
     OwnPtr<AnimationClock> m_animationClock;
     RefPtr<DocumentTimeline> m_timeline;
     RefPtr<DocumentTimeline> m_transitionTimeline;
     CompositorPendingAnimations m_compositorPendingAnimations;
 
     RefPtr<Document> m_templateDocument;
     Document* m_templateDocumentHost; // Manually managed weakref (backpointer from m_templateDocument).

[haraken, 2014/04/25 05:21:42]

Is this raw pointer safe? I guess you'll need to use a Member for this.

[Mads Ager (chromium), 2014/04/25 10:58:25]

This is safe for now.

This is always accessed via m_templateDocument which is a RefPtr and therefore
we know that m_templateDocument is alive.

~Document()
{
    ...
    if (m_templateDocument)
        m_templateDocument->m_templateDocumentHost = 0;
    ...
}

It is not entirely clear to me if this should be a WeakMember or a Member long
term. But it is safe for this change.

 
     Timer<Document> m_didAssociateFormControlsTimer;
     HashSet<RefPtr<Element> > m_associatedFormControls;
 
     HashSet<SVGUseElement*> m_useElementsNeedingUpdate;
     HashSet<Element*> m_layerUpdateElements;
 
     bool m_hasViewportUnits;
 
-    HashSet<DocumentVisibilityObserver*> m_visibilityObservers;
+    typedef WillBeHeapHashSet<RawPtrWillBeWeakMember<DocumentVisibilityObserver> > DocumentVisibilityObserverSet;
+    DocumentVisibilityObserverSet m_visibilityObservers;
 };
 
 inline void Document::notifyRemovePendingSheetIfNeeded()
 {
     if (m_needsNotifyRemoveAllPendingStylesheet)
         didRemoveAllPendingStylesheet();
 }
 
 inline bool Document::shouldOverrideLegacyDescription(ViewportDescription::Type origin)
 {
@@ skipping 43 matching lines @@
 inline bool Node::isDocumentNode() const
 {
     return this == document();
 }
 
 Node* eventTargetNodeForDocument(Document*);
 
 } // namespace WebCore
 
 #endif // Document_h