Oilpan: move node/element rare data objects to the heap.

Source/core/dom/Node.cpp

Index: Source/core/dom/Node.cpp
diff --git a/Source/core/dom/Node.cpp b/Source/core/dom/Node.cpp
index 0798dda6c5b079fdd35680c844fb3a3dd533d867..fbf602f549502fed51e74947d6a99f1117eaf324 100644
--- a/Source/core/dom/Node.cpp
+++ b/Source/core/dom/Node.cpp
@@ -266,14 +266,18 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
+#if !ENABLE(OILPAN)
     if (hasRareData())
         clearRareData();
 
     RELEASE_ASSERT(!renderer());
 
-#if !ENABLE(OILPAN)
     if (!isContainerNode())
         willBeDeletedFromDocument();
+#else
+    // With Oilpan, the rare data finalizer also asserts for
+    // this condition (we cannot directly access it here.)
+    RELEASE_ASSERT(hasRareData() || !renderer());
 #endif
 
     if (m_previous)
@@ -326,36 +330,32 @@ NodeRareData& Node::ensureRareData()
     if (hasRareData())
         return *rareData();
 
-    NodeRareData* data;
     if (isElementNode())
-        data = ElementRareData::create(m_data.m_renderer).leakPtr();
+        m_data.m_rareData = ElementRareData::create(m_data.m_renderer);
     else
-        data = NodeRareData::create(m_data.m_renderer).leakPtr();
-    ASSERT(data);
+        m_data.m_rareData = NodeRareData::create(m_data.m_renderer);
+
+    ASSERT(m_data.m_rareData);
 
-    m_data.m_rareData = data;
     setFlag(HasRareDataFlag);
-    return *data;
+    return *rareData();
 }
 
+#if !ENABLE(OILPAN)
 void Node::clearRareData()
 {
     ASSERT(hasRareData());
     ASSERT(!transientMutationObserverRegistry() || transientMutationObserverRegistry()->isEmpty());

[haraken, 2014/05/05 16:54:52]

I'd like to keep this ASSERT somewhere. The ASSERT about
transientMutationObserverRegistry would be worth having in oilpan builds.

[haraken, 2014/05/05 16:59:33]

^^^ Ignore this comment. This comment is inconsistent with my other comment
saying that transientRegistry should be a hash set of weak members.

 
     RenderObject* renderer = m_data.m_rareData->renderer();
-    if (isElementNode()) {
-        ElementRareData* rareData = static_cast<ElementRareData*>(m_data.m_rareData);
-        rareData->dispose();
-        delete rareData;
-    } else {
-        NodeRareData* rareData = static_cast<NodeRareData*>(m_data.m_rareData);
-        rareData->dispose();
-        delete rareData;
-    }
+    if (isElementNode())
+        delete static_cast<ElementRareData*>(m_data.m_rareData);
+    else
+        delete static_cast<NodeRareData*>(m_data.m_rareData);
     m_data.m_renderer = renderer;
     clearFlag(HasRareDataFlag);
 }
+#endif
 
 Node* Node::toNode()
 {
@@ -2138,7 +2138,7 @@ void Node::registerMutationObserver(MutationObserver& observer, MutationObserver
     }
 
     if (!registration) {
-        registry.append(MutationObserverRegistration::create(observer, *this, options, attributeFilter));
+        registry.append(MutationObserverRegistration::create(observer, this, options, attributeFilter));
         registration = registry.last().get();
     }
 
@@ -2161,9 +2161,11 @@ void Node::unregisterMutationObserver(MutationObserverRegistration* registration
     // before that, in case |this| is destroyed (see MutationObserverRegistration::m_registrationNodeKeepAlive).
     // FIXME: Simplify the registration/transient registration logic to make this understandable by humans.
     RefPtr<Node> protect(this);
-    // The explicit dispose() is motivated by Oilpan; the registration
-    // object needs to unregister itself promptly.
+#if ENABLE(OILPAN)
+    // The explicit dispose() is needed to have the registration
+    // object unregister itself promptly.
     registration->dispose();
+#endif
     registry->remove(index);
 }
 
@@ -2571,6 +2573,9 @@ void Node::setCustomElementState(CustomElementState newState)
 
 void Node::trace(Visitor* visitor)
 {
+    if (hasRareData())
+        visitor->trace(rareData());
+
     visitor->trace(m_treeScope);
 }