Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/MutationObserverRegistration.cpp

Index: Source/core/dom/MutationObserverRegistration.cpp
diff --git a/Source/core/dom/MutationObserverRegistration.cpp b/Source/core/dom/MutationObserverRegistration.cpp
index 2680bb73b6601eb2e57e356936c800d56c623464..ab723fa4535e78fc27bb99603de702cb177d1df9 100644
--- a/Source/core/dom/MutationObserverRegistration.cpp
+++ b/Source/core/dom/MutationObserverRegistration.cpp
@@ -37,9 +37,9 @@
 
 namespace WebCore {
 
-PassOwnPtr<MutationObserverRegistration> MutationObserverRegistration::create(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
+PassOwnPtrWillBeRawPtr<MutationObserverRegistration> MutationObserverRegistration::create(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
 {
-    return adoptPtr(new MutationObserverRegistration(observer, registrationNode, options, attributeFilter));
+    return adoptPtrWillBeNoop(new MutationObserverRegistration(observer, registrationNode, options, attributeFilter));
 }
 
 MutationObserverRegistration::MutationObserverRegistration(MutationObserver& observer, Node& registrationNode, MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
@@ -53,8 +53,27 @@ MutationObserverRegistration::MutationObserverRegistration(MutationObserver& obs
 
 MutationObserverRegistration::~MutationObserverRegistration()
 {
+#if ENABLE(OILPAN)
+    // The observer is heap allocated, and cannot be accessed.
+    //
+    // So should an observer still have this object in its
+    // list of registrations, and that observer lives beyond
+    // the current sweep, this dead registration object might
+    // be attempted accessed. Hence, insist that all
+    // MutationObserverRegistration objects are explicitly
+    // dispose()d before being let go of.
+    ASSERT(!m_observer);
+#endif
+    dispose();
+}
+
+void MutationObserverRegistration::dispose()
+{
     clearTransientRegistrations();
-    m_observer->observationEnded(this);
+    if (m_observer) {
+        m_observer->observationEnded(this);

[haraken, 2014/04/15 02:33:25]

If you make MutationObserver::m_registration a hash set of weak members, you
don't need to call observationEnded().

+        m_observer.clear();
+    }
 }
 
 void MutationObserverRegistration::resetObservation(MutationObserverOptions options, const HashSet<AtomicString>& attributeFilter)
@@ -130,4 +149,9 @@ void MutationObserverRegistration::addRegistrationNodesToSet(HashSet<Node*>& nod
         nodes.add(iter->get());
 }
 
+void MutationObserverRegistration::trace(Visitor* visitor)
+{
+    visitor->trace(m_observer);
+}
+
 } // namespace WebCore