Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/MutationObserverRegistration.h

Index: Source/core/dom/MutationObserverRegistration.h
diff --git a/Source/core/dom/MutationObserverRegistration.h b/Source/core/dom/MutationObserverRegistration.h
index 8bc80d4faf2ab9c04dd64dbf707e0a8721d2373e..7668c09b115c78a31a385dd3a26cf3a0bc468d6c 100644
--- a/Source/core/dom/MutationObserverRegistration.h
+++ b/Source/core/dom/MutationObserverRegistration.h
@@ -32,6 +32,7 @@
 #define MutationObserverRegistration_h
 
 #include "core/dom/MutationObserver.h"
+#include "platform/heap/Handle.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/AtomicString.h"
 #include "wtf/text/AtomicStringHash.h"
@@ -40,9 +41,9 @@ namespace WebCore {
 
 class QualifiedName;
 
-class MutationObserverRegistration {
+class MutationObserverRegistration FINAL : public NoBaseWillBeGarbageCollectedFinalized<MutationObserverRegistration> {
 public:
-    static PassOwnPtr<MutationObserverRegistration> create(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
+    static PassOwnPtrWillBeRawPtr<MutationObserverRegistration> create(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
     ~MutationObserverRegistration();
 
     void resetObservation(MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
@@ -60,10 +61,14 @@ public:
 
     void addRegistrationNodesToSet(HashSet<Node*>&) const;
 
+    void trace(Visitor*);
+
+    void dispose();
+
 private:
     MutationObserverRegistration(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
 
-    RefPtr<MutationObserver> m_observer;
+    RefPtrWillBeMember<MutationObserver> m_observer;
     Node& m_registrationNode;

[haraken, 2014/04/15 02:33:25]

Is this raw pointer safe even if MutationObserverRegistration outlives the Node?

I guess that MutationObserverRegistration cannot outlive the registration Node
in the non-oilpan world, but it can outlive in the oilpan world because
MutationObserverRegistration's destruction is delayed to the next GC timing.

[sof, 2014/04/15 22:00:53]

If that should happen (the registration object outlives its m_registrationNode),
then that reference can only be accessed by way of its MutationObserver (calling
disconnect() or getObservedNodes() on it.) Which is a possibility, I'm quite
sure.

Should we turn it into a pointer reference and clear it in dispose() instead?

[haraken, 2014/04/16 07:23:58]

This sounds nicer.

     RefPtr<Node> m_registrationNodeKeepAlive;
     typedef HashSet<RefPtr<Node> > NodeHashSet;