Oilpan: add [WillBeGarbageCollected] for Node.

Source/core/frame/DOMWindow.cpp

Index: Source/core/frame/DOMWindow.cpp
diff --git a/Source/core/frame/DOMWindow.cpp b/Source/core/frame/DOMWindow.cpp
index b9c97b3316aaff6568f0a4ea352bb8318fa83a78..a06b148d30808fc6f6e30e49db3bb8f04dd949e1 100644
--- a/Source/core/frame/DOMWindow.cpp
+++ b/Source/core/frame/DOMWindow.cpp
@@ -363,9 +363,9 @@ void DOMWindow::clearEventQueue()
     m_eventQueue.clear();
 }
 
-PassRefPtr<Document> DOMWindow::createDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
+PassRefPtrWillBeRawPtr<Document> DOMWindow::createDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
 {
-    RefPtr<Document> document;
+    RefPtrWillBeRawPtr<Document> document;

[haraken, 2014/05/23 08:32:14]

= nullptr

     if (forceXHTML) {
         // This is a hack for XSLTProcessor. See XSLTProcessor::createDocumentFromSource().
         document = Document::create(init);
@@ -378,7 +378,7 @@ PassRefPtr<Document> DOMWindow::createDocument(const String& mimeType, const Doc
     return document.release();
 }
 
-PassRefPtr<Document> DOMWindow::installNewDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
+PassRefPtrWillBeRawPtr<Document> DOMWindow::installNewDocument(const String& mimeType, const DocumentInit& init, bool forceXHTML)
 {
     ASSERT(init.frame() == m_frame);
 
@@ -486,15 +486,20 @@ DOMWindow::~DOMWindow()
     ASSERT(m_hasBeenReset);
     reset();
 
+#if ENABLE(OILPAN)
+    // Stub out early to prevent Document access in removeAllEventListeners().
+    m_document = nullptr;
+#endif
+
     removeAllEventListeners();
 
 #if ENABLE(OILPAN)
-    ASSERT(m_document->isDisposed());
+    // FIXME: This should be part of ActiveDOM Object shutdown
+    clearEventQueue();

[haraken, 2014/05/23 08:32:14]

I guess you need to call Document::clearDOMWindow, because the Document can
outlive the DOMWindow.

I also wonder why we don't need to call Document::detach() in a case where the
Document outlives the DOMWindow.

[sof, 2014/05/23 08:56:33]

Hmm, Document needs to clear out its weak back reference to DOMWindow. Will
investigate the FIXME in clearDocument() wrt detach().

[sof, 2014/05/23 10:53:03]

Now arranged for in the other direction by having Document clear out its weak
reference.
I've found no evidence of clearDocument()'s detach() (via ~DOMWindow)
activating.

The regular path is for detaching to be handled by
Document::prepareForDestruction(), as called by the frame. When might a window
on destruction need to detach the document from its frame?

 #else
     ASSERT(m_document->isStopped());
-#endif
-
     clearDocument();
+#endif
 }
 
 const AtomicString& DOMWindow::interfaceName() const
@@ -1872,6 +1877,7 @@ PassOwnPtr<LifecycleNotifier<DOMWindow> > DOMWindow::createLifecycleNotifier()
 
 void DOMWindow::trace(Visitor* visitor)
 {
+    visitor->trace(m_document);
     visitor->trace(m_screen);
     visitor->trace(m_history);
     visitor->trace(m_locationbar);