Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/MutationObserverRegistration.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 19 matching lines @@
 
 #include "config.h"
 
 #include "core/dom/MutationObserverRegistration.h"
 
 #include "core/dom/Node.h"
 #include "core/dom/QualifiedName.h"
 
 namespace WebCore {
 
-PassOwnPtr<MutationObserverRegistration> MutationObserverRegistration::create(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
+PassOwnPtrWillBeRawPtr<MutationObserverRegistration> MutationObserverRegistration::create(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
 {
-    return adoptPtr(new MutationObserverRegistration(observer, registrationNode, options, attributeFilter));
+    return adoptPtrWillBeNoop(new MutationObserverRegistration(observer, registrationNode, options, attributeFilter));
 }
 
 MutationObserverRegistration::MutationObserverRegistration(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
     : m_observer(observer)
     , m_registrationNode(registrationNode)
     , m_options(options)
     , m_attributeFilter(attributeFilter)
 {
     m_observer->observationStarted(this);
 }
 
 MutationObserverRegistration::~MutationObserverRegistration()
 {
+#if ENABLE(OILPAN)
+    // The observer is heap allocated, and cannot be accessed.
+    //
+    // So should an observer still have this object in its
+    // list of registrations, and that observer lives beyond
+    // the current sweep, this dead registration object might
+    // be attempted accessed. Hence, insist that all
+    // MutationObserverRegistration objects are explicitly
+    // dispose()d before being let go of.
+    ASSERT(!m_observer);
+#endif
+    dispose();
+}
+
+void MutationObserverRegistration::dispose()
+{
     clearTransientRegistrations();
-    m_observer->observationEnded(this);
+    if (m_observer) {
+        m_observer->observationEnded(this);

[haraken, 2014/04/15 02:33:25]

If you make MutationObserver::m_registration a hash set of weak members, you
don't need to call observationEnded().

+        m_observer.clear();
+    }
 }
 
 void MutationObserverRegistration::resetObservation(MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
 {
     clearTransientRegistrations();
     m_options = options;
     m_attributeFilter = attributeFilter;
 }
 
 void MutationObserverRegistration::observedSubtreeNodeWillDetach(Node& node)
@@ skipping 55 matching lines @@
 
 void MutationObserverRegistration::addRegistrationNodesToSet(HashSet<Node*>& nodes) const
 {
     nodes.add(&m_registrationNode);
     if (!m_transientRegistrationNodes)
         return;
     for (NodeHashSet::const_iterator iter = m_transientRegistrationNodes->begin(); iter != m_transientRegistrationNodes->end(); ++iter)
         nodes.add(iter->get());
 }
 
+void MutationObserverRegistration::trace(Visitor* visitor)
+{
+    visitor->trace(m_observer);
+}
+
 } // namespace WebCore