Oilpan: Prepare to move RenderObject and RenderObjectChildList to Oilpan heap.

Source/core/rendering/RenderWidget.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 22 matching lines @@
 #include "core/rendering/RenderLayer.h"
 #include "core/rendering/RenderView.h"
 #include "core/rendering/compositing/CompositedLayerMapping.h"
 #include "core/rendering/compositing/RenderLayerCompositor.h"
 #include "wtf/HashMap.h"
 
 namespace blink {
 
 RenderWidget::RenderWidget(Element* element)
     : RenderReplaced(element)
+#if !ENABLE(OILPAN)
     // Reference counting is used to prevent the widget from being
     // destroyed while inside the Widget code, which might not be
     // able to handle that.
     , m_refCount(1)
+#endif
 {
     ASSERT(element);
     frameView()->addWidget(this);
 }
 
 void RenderWidget::willBeDestroyed()
 {
     frameView()->removeWidget(this);
 
     if (AXObjectCache* cache = document().existingAXObjectCache()) {
         cache->childrenChanged(this->parent());
         cache->remove(this);
     }
 
     Element* element = toElement(node());
     if (element && element->isFrameOwnerElement())
         toHTMLFrameOwnerElement(element)->setWidget(nullptr);
 
     RenderReplaced::willBeDestroyed();
 }
 
 void RenderWidget::destroy()
 {
+#if ENABLE(ASSERT) && ENABLE(OILPAN)
+    m_didCallDestroy = true;
+#endif
     willBeDestroyed();
     clearNode();
+#if ENABLE(OILPAN)
+    // In Oilpan, postDestroy doesn't delete |this|. So calling it here is safe
+    // though |this| will be referred in FrameView.
+    postDestroy();
+#else
     deref();
+#endif
 }
 
 RenderWidget::~RenderWidget()
 {
+#if !ENABLE(OILPAN)
     ASSERT(m_refCount <= 0);
+#endif
 }
 
 Widget* RenderWidget::widget() const
 {
     // Plugin widgets are stored in their DOM node. This includes HTMLAppletElement.
     Element* element = toElement(node());
 
     if (element && element->isFrameOwnerElement())
         return toHTMLFrameOwnerElement(element)->ownedWidget();
 
@@ skipping 14 matching lines @@
         return false;
 
     Widget* widget = this->widget();
     ASSERT(widget);
 
     IntRect newFrame = roundedIntRect(frame);
 
     if (widget->frameRect() == newFrame)
         return false;
 
-    RefPtr<RenderWidget> protector(this);
+    RefPtrWillBeRawPtr<RenderWidget> protector(this);
     RefPtrWillBeRawPtr<Node> protectedNode(node());
     widget->setFrameRect(newFrame);
     return widget->frameRect().size() != newFrame.size();
 }
 
 bool RenderWidget::updateWidgetGeometry()
 {
     Widget* widget = this->widget();
     ASSERT(widget);
 
@@ skipping 118 matching lines @@
 }
 
 void RenderWidget::setIsOverlapped(bool isOverlapped)
 {
     Widget* widget = this->widget();
     ASSERT(widget);
     ASSERT(widget->isFrameView());
     toFrameView(widget)->setIsOverlapped(isOverlapped);
 }
 
+#if !ENABLE(OILPAN)
 void RenderWidget::deref()
 {
     if (--m_refCount <= 0)
         postDestroy();
 }
+#endif
 
 void RenderWidget::updateOnWidgetChange()
 {
     Widget* widget = this->widget();
     if (!widget)
         return;
 
     if (!style())
         return;
 
@@ skipping 49 matching lines @@
 CursorDirective RenderWidget::getCursor(const LayoutPoint& point, Cursor& cursor) const
 {
     if (widget() && widget()->isPluginView()) {
         // A plug-in is responsible for setting the cursor when the pointer is over it.
         return DoNotSetCursor;
     }
     return RenderReplaced::getCursor(point, cursor);
 }
 
 } // namespace blink