Oilpan: move 2D Canvas and WebGL objects to the heap.

Source/core/html/canvas/WebGLExtension.h

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 10 matching lines @@
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef WebGLExtension_h
 #define WebGLExtension_h
 
 #include "core/html/canvas/WebGLExtensionName.h"
 #include "core/html/canvas/WebGLRenderingContextBase.h"
+#include "platform/heap/Handle.h"
 #include "wtf/RefCounted.h"
 
 namespace WebCore {
 
-class WebGLExtension : public RefCounted<WebGLExtension> {
-    WTF_MAKE_FAST_ALLOCATED;
+class WebGLExtension : public RefCountedWillBeGarbageCollectedFinalized<WebGLExtension> {
+    WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED;
 public:
     WebGLRenderingContextBase* context() { return m_context; }
 
     virtual ~WebGLExtension();
     virtual WebGLExtensionName name() const = 0;
 
     // Lose this extension. Passing true = force loss. Some extensions
     // like WEBGL_lose_context are not normally lost when the context
     // is lost but must be lost when destroying their WebGLRenderingContextBase.
     virtual void lose(bool)
     {
-        m_context = 0;
+        m_context = nullptr;
     }
 
     bool isLost()
     {
         return !m_context;
     }
 
+    virtual void trace(Visitor*);
+
 protected:
     WebGLExtension(WebGLRenderingContextBase*);
 
-    WebGLRenderingContextBase* m_context;
+    RawPtrWillBeWeakMember<WebGLRenderingContextBase> m_context;

[sof, 2014/07/01 13:54:11]

Once the context object disappears, it is cleared from any extension objects
that refer to it. i.e., an extension object shouldn't keep the context alive
(via a reference to it from its wrapper, for instance.)

 };
 
 } // namespace WebCore
 
 #endif // WebGLExtension_h