Oilpan: Make the Node hierarchy RefCountedGarbageCollected instead of TreeShared.

Source/core/html/FormAssociatedElement.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 18 matching lines @@
 #include "core/dom/IdTargetObserver.h"
 #include "core/html/HTMLFormControlElement.h"
 #include "core/html/HTMLFormElement.h"
 #include "core/html/HTMLObjectElement.h"
 #include "core/html/ValidityState.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-class FormAttributeTargetObserver : IdTargetObserver {
+class FormAttributeTargetObserver : public IdTargetObserver {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<FormAttributeTargetObserver> create(const AtomicString& id, FormAssociatedElement*);
     virtual void idTargetChanged() OVERRIDE;
 
 private:
     FormAttributeTargetObserver(const AtomicString& id, FormAssociatedElement*);
 
     FormAssociatedElement* m_element;
 };
@@ skipping 13 matching lines @@
     if (!m_validityState)
         m_validityState = ValidityState::create(this);
 
     return m_validityState.get();
 }
 
 void FormAssociatedElement::didMoveToNewDocument(Document& oldDocument)
 {
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr))
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);
 }
 
 void FormAssociatedElement::insertedInto(ContainerNode* insertionPoint)
 {
     if (!m_formWasSetByParser || insertionPoint->highestAncestorOrSelf() != m_form->highestAncestorOrSelf())
         resetFormOwner();
 
     if (!insertionPoint->inDocument())
         return;
 
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr))
         resetFormAttributeTargetObserver();
 }
 
 void FormAssociatedElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement* element = toHTMLElement(this);
     if (insertionPoint->inDocument() && element->fastHasAttribute(formAttr))
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);

[haraken, 2014/05/06 04:20:16]

The observer is unregistered when FormAssociatedElement::removedFrom is called,
but how is the observer unregistered when FormAssociatedElement is destructed?

[Mads Ager (chromium), 2014/05/06 08:26:00]

m_formAttributeTargetObserver is only non-null in the destructor when the
TreeScope is also dead. In that case it doesn't have to unregister itself
because the registry is part of the TreeScope and is therefore also dead.

[Erik Corry, 2014/05/06 08:29:40]

My guess is that the observer is in the form, which is in the document, and so
they all die together if the observed object is in the document tree.

     // If the form and element are both in the same tree, preserve the connection to the form.
     // Otherwise, null out our form and remove ourselves from the form's list of elements.
     if (m_form && element->highestAncestorOrSelf() != m_form->highestAncestorOrSelf())
         resetFormOwner();
 }
 
 HTMLFormElement* FormAssociatedElement::findAssociatedForm(const HTMLElement* element)
 {
     const AtomicString& formId(element->fastGetAttribute(formAttr));
     // 3. If the element is reassociateable, has a form content attribute, and
@@ skipping 142 matching lines @@
 String FormAssociatedElement::validationMessage() const
 {
     return customError() ? m_customValidationMessage : String();
 }
 
 void FormAssociatedElement::setCustomValidity(const String& error)
 {
     m_customValidationMessage = error;
 }
 
+void FormAssociatedElement::setFormAttributeTargetObserver(PassOwnPtr<FormAttributeTargetObserver> newObserver)
+{
+    if (m_formAttributeTargetObserver)
+        m_formAttributeTargetObserver->unregister();
+    m_formAttributeTargetObserver = newObserver;
+}
+
 void FormAssociatedElement::resetFormAttributeTargetObserver()
 {
     HTMLElement* element = toHTMLElement(this);
     const AtomicString& formId(element->fastGetAttribute(formAttr));
     if (!formId.isNull() && element->inDocument())
-        m_formAttributeTargetObserver = FormAttributeTargetObserver::create(formId, this);
+        setFormAttributeTargetObserver(FormAttributeTargetObserver::create(formId, this));
     else
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);
 }
 
 void FormAssociatedElement::formAttributeTargetChanged()
 {
     resetFormOwner();
 }
 
 const AtomicString& FormAssociatedElement::name() const
 {
     const AtomicString& name = toHTMLElement(this)->getNameAttribute();
@@ skipping 39 matching lines @@
     , m_element(element)
 {
 }
 
 void FormAttributeTargetObserver::idTargetChanged()
 {
     m_element->formAttributeTargetChanged();
 }
 
 } // namespace Webcore