Oilpan: move 2D Canvas and WebGL objects to the heap.

Source/core/html/canvas/WebGLExtension.h

Index: Source/core/html/canvas/WebGLExtension.h
diff --git a/Source/core/html/canvas/WebGLExtension.h b/Source/core/html/canvas/WebGLExtension.h
index 66e072ed2de5fe3ae18949ac6f9f33442b1a7f38..78bf36f8058de5ee676896a43e2311942a058d34 100644
--- a/Source/core/html/canvas/WebGLExtension.h
+++ b/Source/core/html/canvas/WebGLExtension.h
@@ -28,12 +28,13 @@
 
 #include "core/html/canvas/WebGLExtensionName.h"
 #include "core/html/canvas/WebGLRenderingContextBase.h"
+#include "platform/heap/Handle.h"
 #include "wtf/RefCounted.h"
 
 namespace WebCore {
 
-class WebGLExtension : public RefCounted<WebGLExtension> {
-    WTF_MAKE_FAST_ALLOCATED;
+class WebGLExtension : public RefCountedWillBeGarbageCollectedFinalized<WebGLExtension> {
+    WTF_MAKE_FAST_ALLOCATED_WILL_BE_REMOVED;
 public:
     WebGLRenderingContextBase* context() { return m_context; }
 
@@ -45,7 +46,7 @@ public:
     // is lost but must be lost when destroying their WebGLRenderingContextBase.
     virtual void lose(bool)
     {
-        m_context = 0;
+        m_context = nullptr;
     }
 
     bool isLost()
@@ -53,10 +54,12 @@ public:
         return !m_context;
     }
 
+    virtual void trace(Visitor*);
+
 protected:
     WebGLExtension(WebGLRenderingContextBase*);
 
-    WebGLRenderingContextBase* m_context;
+    RawPtrWillBeWeakMember<WebGLRenderingContextBase> m_context;

[sof, 2014/07/01 13:54:11]

Once the context object disappears, it is cleared from any extension objects
that refer to it. i.e., an extension object shouldn't keep the context alive
(via a reference to it from its wrapper, for instance.)

 };
 
 } // namespace WebCore