Move Frame to the Oilpan heap.

Source/core/frame/DOMWindowProperty.cpp

 /*
  * Copyright (C) 2011 Google, Inc. All Rights Reserved.
  * Copyright (C) 2012 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 16 matching lines @@
 #include "config.h"
 #include "core/frame/DOMWindowProperty.h"
 
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/LocalFrame.h"
 
 namespace blink {
 
 DOMWindowProperty::DOMWindowProperty(LocalFrame* frame)
     : m_frame(frame)
-    , m_associatedDOMWindow(0)
+    , m_associatedDOMWindow(nullptr)
 {
     // FIXME: For now it *is* acceptable for a DOMWindowProperty to be created with a null frame.
     // See fast/dom/navigator-detached-no-crash.html for the recipe.
     // We should fix that.  <rdar://problem/11567132>
-    if (m_frame) {
+    if (this->frame()) {

[haraken, 2014/09/08 07:25:57]

What is this change for?

[sof, 2014/09/08 21:17:45]

Reverted back (a leftover from an experiment to see what it would take to make
m_frame a private across the codebase.)

         m_associatedDOMWindow = m_frame->domWindow();
         m_associatedDOMWindow->registerProperty(this);
     }
 }
 
+#if !ENABLE(OILPAN)
 DOMWindowProperty::~DOMWindowProperty()

[haraken, 2014/09/08 07:25:57]

Is it guaranteed that willDestroyGlobalObjectInFrame is called before
DOMWindowProperty's destructor is called?

If yes, let's add ASSERT(!m_frame).

If no, you'll need to change LocalDOMWindow::m_properties to a hash set of weak
members, so that the DOMWindowProperty gets removed from the hash set when the
DOMWindowProperty gets destructed.

[sof, 2014/09/08 21:17:45]

LocalDOMWindow::reset() calls willDestroyGlobalObjectInFrame() and is not
guaranteed to be called with Oilpan.

As DOMWindowProperty and LocalDOMWindow keep strong references to one another, I
don't see the need to do what you suggest. The m_frame reference is a weak one,
so it'll be cleared for the DOMWindowProperty (as it will be for the
FrameDestructionObserver-derived LocalDOMWindow.)

As it is now, ~DOMWindowProperty has no destructor with Oilpan. I hope we can
remove some upstream *Finalized uses as a result (but haven't looked into
details yet.)

 {
     if (m_associatedDOMWindow)
         m_associatedDOMWindow->unregisterProperty(this);
 
-    m_associatedDOMWindow = 0;
-    m_frame = 0;
+    m_associatedDOMWindow = nullptr;
+    m_frame = nullptr;
 }
+#endif
 
 void DOMWindowProperty::willDestroyGlobalObjectInFrame()
 {
     // If the property is getting this callback it must have been created with a LocalFrame/LocalDOMWindow and it should still have them.
     ASSERT(m_frame);
     ASSERT(m_associatedDOMWindow);
 
     // DOMWindowProperty lifetime isn't tied directly to the LocalDOMWindow itself so it is important that it unregister
     // itself from any LocalDOMWindow it is associated with if that LocalDOMWindow is going away.
     if (m_associatedDOMWindow)
         m_associatedDOMWindow->unregisterProperty(this);
-    m_associatedDOMWindow = 0;
-    m_frame = 0;
+    m_associatedDOMWindow = nullptr;
+    m_frame = nullptr;
 }
 
 void DOMWindowProperty::willDetachGlobalObjectFromFrame()
 {
     // If the property is getting this callback it must have been created with a LocalFrame/LocalDOMWindow and it should still have them.
     ASSERT(m_frame);
     ASSERT(m_associatedDOMWindow);
 }
 
+void DOMWindowProperty::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+    visitor->trace(m_associatedDOMWindow);
 }
+
+}