Oilpan: Make the Node hierarchy RefCountedGarbageCollected instead of TreeShared.

Source/core/html/FormAssociatedElement.cpp

Index: Source/core/html/FormAssociatedElement.cpp
diff --git a/Source/core/html/FormAssociatedElement.cpp b/Source/core/html/FormAssociatedElement.cpp
index a34beaacfff356699497c7a6d6e2b5a1f84a626b..46fc8b51335a12c36166786b6ebba8fa67ca7b35 100644
--- a/Source/core/html/FormAssociatedElement.cpp
+++ b/Source/core/html/FormAssociatedElement.cpp
@@ -36,7 +36,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-class FormAttributeTargetObserver : IdTargetObserver {
+class FormAttributeTargetObserver : public IdTargetObserver {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<FormAttributeTargetObserver> create(const AtomicString& id, FormAssociatedElement*);
@@ -70,7 +70,7 @@ void FormAssociatedElement::didMoveToNewDocument(Document& oldDocument)
 {
     HTMLElement* element = toHTMLElement(this);
     if (element->fastHasAttribute(formAttr))
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);
 }
 
 void FormAssociatedElement::insertedInto(ContainerNode* insertionPoint)
@@ -90,7 +90,7 @@ void FormAssociatedElement::removedFrom(ContainerNode* insertionPoint)
 {
     HTMLElement* element = toHTMLElement(this);
     if (insertionPoint->inDocument() && element->fastHasAttribute(formAttr))
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);

[haraken, 2014/05/06 04:20:16]

The observer is unregistered when FormAssociatedElement::removedFrom is called,
but how is the observer unregistered when FormAssociatedElement is destructed?

[Mads Ager (chromium), 2014/05/06 08:26:00]

m_formAttributeTargetObserver is only non-null in the destructor when the
TreeScope is also dead. In that case it doesn't have to unregister itself
because the registry is part of the TreeScope and is therefore also dead.

[Erik Corry, 2014/05/06 08:29:40]

My guess is that the observer is in the form, which is in the document, and so
they all die together if the observed object is in the document tree.

     // If the form and element are both in the same tree, preserve the connection to the form.
     // Otherwise, null out our form and remove ourselves from the form's list of elements.
     if (m_form && element->highestAncestorOrSelf() != m_form->highestAncestorOrSelf())
@@ -253,14 +253,21 @@ void FormAssociatedElement::setCustomValidity(const String& error)
     m_customValidationMessage = error;
 }
 
+void FormAssociatedElement::setFormAttributeTargetObserver(PassOwnPtr<FormAttributeTargetObserver> newObserver)
+{
+    if (m_formAttributeTargetObserver)
+        m_formAttributeTargetObserver->unregister();
+    m_formAttributeTargetObserver = newObserver;
+}
+
 void FormAssociatedElement::resetFormAttributeTargetObserver()
 {
     HTMLElement* element = toHTMLElement(this);
     const AtomicString& formId(element->fastGetAttribute(formAttr));
     if (!formId.isNull() && element->inDocument())
-        m_formAttributeTargetObserver = FormAttributeTargetObserver::create(formId, this);
+        setFormAttributeTargetObserver(FormAttributeTargetObserver::create(formId, this));
     else
-        m_formAttributeTargetObserver = nullptr;
+        setFormAttributeTargetObserver(nullptr);
 }
 
 void FormAssociatedElement::formAttributeTargetChanged()