Oilpan: add transition types to track interface objects.

Source/core/html/HTMLTrackElement.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 42 matching lines @@
 inline HTMLTrackElement::HTMLTrackElement(Document& document)
     : HTMLElement(trackTag, document)
     , m_loadTimer(this, &HTMLTrackElement::loadTimerFired)
 {
     WTF_LOG(Media, "HTMLTrackElement::HTMLTrackElement - %p", this);
     ScriptWrappable::init(this);
 }
 
 HTMLTrackElement::~HTMLTrackElement()
 {
-    if (m_track)

[Mads Ager (chromium), 2014/04/22 13:07:15]

We should probably be careful and wrap this in #if !ENABLE(OILPAN) instead of
just deleting it?

[sof, 2014/04/22 14:02:48]

I don't mind putting it back in (even if I risk getting complaints of redundant
#ifs :) ), but like for HTMLMediaElement & TextTrackList, the element will not
be used. HTMLTrackElement created the track object & it will be destructed just
afterwards in the non-Oilpan case.

[Mads Ager (chromium), 2014/04/22 14:17:59]

What if it has a JavaScript wrapper which also keeps it alive and can interact
with it? Use-after-free? We need to be very careful when removing pointer
clearing in the non-oilpan build. Some of them can probably be removed but it is
very dangerous.

-        m_track->clearTrackElement();
 }
 
 PassRefPtr<HTMLTrackElement> HTMLTrackElement::create(Document& document)
 {
     return adoptRef(new HTMLTrackElement(document));
 }
 
 Node::InsertionNotificationRequest HTMLTrackElement::insertedInto(ContainerNode* insertionPoint)
 {
     WTF_LOG(Media, "HTMLTrackElement::insertedInto");
@@ skipping 190 matching lines @@
 }
 
 HTMLMediaElement* HTMLTrackElement::mediaElement() const
 {
     Element* parent = parentElement();
     if (isHTMLMediaElement(parent))
         return toHTMLMediaElement(parent);
     return 0;
 }
 
+void HTMLTrackElement::trace(Visitor* visitor)
+{
+    visitor->trace(m_track);
+    HTMLElement::trace(visitor);
 }
+
+}