Oilpan: use transition types for remaining RefPtr<Document>s in dom/.

Source/core/dom/Range.cpp

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Gunnstein Lye (gunnstein@netcom.no)
  * (C) 2000 Frederik Holljen (frederik.holljen@hig.no)
  * (C) 2001 Peter Kelly (pmk@post.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Motorola Mobility. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ skipping 89 matching lines @@
 }
 
 PassRefPtrWillBeRawPtr<Range> Range::create(Document& ownerDocument, const Position& start, const Position& end)
 {
     return adoptRefWillBeNoop(new Range(ownerDocument, start.containerNode(), start.computeOffsetInContainerNode(), end.containerNode(), end.computeOffsetInContainerNode()));
 }
 
 Range::~Range()
 {
     // Always detach (even if we've already detached) to fix https://bugs.webkit.org/show_bug.cgi?id=26044
     m_ownerDocument->detachRange(this);

[haraken, 2014/06/02 14:38:43]

You cannot touch an on-heap object in a destructor.

I guess you need to make Document::m_range a hash set of weak members and remove
this line from oilpan builds.

[sof, 2014/06/02 14:41:02]

Sorry, forgot to check this dtor. Will address.

[sof, 2014/06/02 16:26:18]

Done.

 
 #ifndef NDEBUG
     rangeCounter.decrement();
 #endif
 }
 
 void Range::setDocument(Document& document)
 {
     ASSERT(m_ownerDocument != document);
     ASSERT(m_ownerDocument);
@@ skipping 1368 matching lines @@
         if (n == nodeToBeRemoved) {
             boundary.setToBeforeChild(nodeToBeRemoved);
             return;
         }
     }
 }
 
 void Range::nodeWillBeRemoved(Node& node)
 {
     ASSERT(node.document() == m_ownerDocument);
-    ASSERT(node != m_ownerDocument);
+    ASSERT(node != m_ownerDocument.get());
 
     // FIXME: Once DOMNodeRemovedFromDocument mutation event removed, we
     // should change following if-statement to ASSERT(!node->parentNode).
     if (!node.parentNode())
         return;
     boundaryNodeWillBeRemoved(m_start, node);
     boundaryNodeWillBeRemoved(m_end, node);
 }
 
 static inline void boundaryTextInserted(RangeBoundaryPoint& boundary, Node* text, unsigned offset, unsigned length)
@@ skipping 161 matching lines @@
     if (quads.isEmpty())
         return FloatRect();
 
     FloatRect result;
     for (size_t i = 0; i < quads.size(); ++i)
         result.unite(quads[i].boundingBox());
 
     return result;
 }
 
-void Range::trace(Visitor*)
+void Range::trace(Visitor* visitor)
 {
+    visitor->trace(m_ownerDocument);
 }
 
 } // namespace WebCore
 
 #ifndef NDEBUG
 
 void showTree(const WebCore::Range* range)
 {
     if (range && range->boundaryPointsValid()) {
         range->startContainer()->showTreeAndMark(range->startContainer(), "S", range->endContainer(), "E");
         fprintf(stderr, "start offset: %d, end offset: %d\n", range->startOffset(), range->endOffset());
     }
 }
 
 #endif