Oilpan: Prepare to move ImageLoader and its subclasses to Oilpan heap.

Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 104 matching lines @@
     if (m_image)
         m_image->removeClient(this);
 
     ASSERT(m_hasPendingLoadEvent || !loadEventSender().hasPendingEvents(this));
     if (m_hasPendingLoadEvent)
         loadEventSender().cancelEvent(this);
 
     ASSERT(m_hasPendingErrorEvent || !errorEventSender().hasPendingEvents(this));
     if (m_hasPendingErrorEvent)
         errorEventSender().cancelEvent(this);
+}
 
-    // If the ImageLoader is being destroyed but it is still protecting its image-loading Element,
-    // remove that protection here.
-    if (m_elementIsProtected)
-        m_element->deref();
+void ImageLoader::trace(Visitor* visitor)
+{
+    visitor->trace(m_element);
 }
 
 void ImageLoader::setImage(ImageResource* newImage)
 {
     setImageWithoutConsideringPendingLoadEvent(newImage);
 
     // Only consider updating the protection ref-count of the Element immediately before returning
     // from this function as doing so might result in the destruction of this ImageLoader.
     updatedHasPendingEvent();
 }
@@ skipping 269 matching lines @@
     // If such an Element wishes for the load to stop when removed from the DOM it needs to stop the ImageLoader explicitly.
     bool wasProtected = m_elementIsProtected;
     m_elementIsProtected = m_hasPendingLoadEvent || m_hasPendingErrorEvent;
     if (wasProtected == m_elementIsProtected)
         return;
 
     if (m_elementIsProtected) {
         if (m_derefElementTimer.isActive())
             m_derefElementTimer.stop();
         else
-            m_element->ref();
+            m_keepAlive = m_element;
     } else {
         ASSERT(!m_derefElementTimer.isActive());
         m_derefElementTimer.startOneShot(0, FROM_HERE);
     }
 }
 
 void ImageLoader::timerFired(Timer<ImageLoader>*)
 {
-    m_element->deref();
+    m_keepAlive.clear();
 }
 
 void ImageLoader::dispatchPendingEvent(ImageEventSender* eventSender)
 {
     ASSERT(eventSender == &loadEventSender() || eventSender == &errorEventSender());
     const AtomicString& eventType = eventSender->eventType();
     if (eventType == EventTypeNames::load)
         dispatchPendingLoadEvent();
     if (eventType == EventTypeNames::error)
         dispatchPendingErrorEvent();
@@ skipping 100 matching lines @@
 }
 
 #if ENABLE(OILPAN)
 ImageLoader::ImageLoaderClientRemover::~ImageLoaderClientRemover()
 {
     m_loader.willRemoveClient(m_client);
 }
 #endif
 
 }