Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/MutationObserver.h

Index: Source/core/dom/MutationObserver.h
diff --git a/Source/core/dom/MutationObserver.h b/Source/core/dom/MutationObserver.h
index 086e600ea428368e05cd9bb3eb91009603317679..3d92d18bffd293a1c8c500d7a9f287c51fb31275 100644
--- a/Source/core/dom/MutationObserver.h
+++ b/Source/core/dom/MutationObserver.h
@@ -32,6 +32,7 @@
 #define MutationObserver_h
 
 #include "bindings/v8/ScriptWrappable.h"
+#include "platform/heap/Handle.h"
 #include "wtf/HashSet.h"
 #include "wtf/PassOwnPtr.h"
 #include "wtf/PassRefPtr.h"
@@ -51,7 +52,7 @@ class Node;
 typedef unsigned char MutationObserverOptions;
 typedef unsigned char MutationRecordDeliveryOptions;
 
-class MutationObserver : public RefCounted<MutationObserver>, public ScriptWrappable {
+class MutationObserver FINAL : public RefCountedWillBeGarbageCollectedFinalized<MutationObserver>, public ScriptWrappable {
 public:
     enum MutationType {
         ChildList = 1 << 0,
@@ -71,23 +72,25 @@ public:
         CharacterDataOldValue = 1 << 6,
     };
 
-    static PassRefPtr<MutationObserver> create(PassOwnPtr<MutationCallback>);
+    static PassRefPtrWillBeRawPtr<MutationObserver> create(PassOwnPtr<MutationCallback>);
     static void resumeSuspendedObservers();
     static void deliverMutations();
 
     ~MutationObserver();
 
     void observe(Node*, const Dictionary&, ExceptionState&);
-    Vector<RefPtr<MutationRecord> > takeRecords();
+    WillBeHeapVector<RefPtrWillBeMember<MutationRecord> > takeRecords();
     void disconnect();
     void observationStarted(MutationObserverRegistration*);
     void observationEnded(MutationObserverRegistration*);
-    void enqueueMutationRecord(PassRefPtr<MutationRecord>);
+    void enqueueMutationRecord(PassRefPtrWillBeRawPtr<MutationRecord>);
     void setHasTransientRegistration();
     bool canDeliver();
 
     HashSet<Node*> getObservedNodes() const;
 
+    void trace(Visitor*);
+
 private:
     struct ObserverLessThan;
 
@@ -95,8 +98,8 @@ private:
     void deliver();
 
     OwnPtr<MutationCallback> m_callback;
-    Vector<RefPtr<MutationRecord> > m_records;
-    HashSet<MutationObserverRegistration*> m_registrations;
+    WillBeHeapVector<RefPtrWillBeMember<MutationRecord> > m_records;
+    WillBeHeapHashSet<RawPtrWillBeMember<MutationObserverRegistration> > m_registrations;

[haraken, 2014/04/15 02:33:25]

Maybe should this be a hash set of weak members? Currently,
MutationObserverRegistration in m_registrations is removed in
MutationObserverRegistration's destructor.

[sof, 2014/04/15 22:00:53]

That will work, but there is an as-yet not understood reason why the
registration object will still have to eagerly de-register/remove itself as a
registration in its dispose(). That is, seeing some rarer and transient crashes
on shutdown at times without it. Hence, I left that call to observationEnded()
in.

[Erik Corry, 2014/04/16 08:02:52]

I think you can have it eagerly deregister itself in dispose, but have it also
be weak so that you don't have to call dispose from the destructor.

     unsigned m_priority;
 };