Move Frame to the Oilpan heap.

Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 45 matching lines @@
 using namespace HTMLNames;
 
 DEFINE_DEBUG_ONLY_GLOBAL(WTF::RefCountedLeakCounter, frameCounter, ("Frame"));
 
 Frame::Frame(FrameClient* client, FrameHost* host, FrameOwner* owner)
     : m_treeNode(this)
     , m_host(host)
     , m_owner(owner)
     , m_client(client)
     , m_remotePlatformLayer(0)
+#if ENABLE(OILPAN)
+    , m_hasBeenClosed(false)
+#endif
 {
     ASSERT(page());
 
 #ifndef NDEBUG
     frameCounter.increment();
 #endif
 
     if (m_owner) {
         page()->incrementSubframeCount();
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->setContentFrame(*this);
     } else {
         page()->setMainFrame(this);
     }
 }
 
 Frame::~Frame()
 {
+    // FIXME: We should not be doing all this work inside the destructor
+    dispose();

[haraken, 2014/09/08 07:25:58]

Shall we rewrite this to:

#if ENABLE(OILPAN)
  ASSERT(!m_owner);
#else
  dispose();
#endif

?

(It would be even better if we could rewrite non-oilpan code so that it uses
explicit dispose() as well. Then we won't need different call paths between
oilpan builds and non-oilpan builds.)

[sof, 2014/09/08 21:17:45]

I've added that as an Oilpan assert (in dispose()); I _believe_ that captures
the gist of this comment.

[sof, 2014/09/11 13:27:05]

This turned out a step too far -- "non local" FrameOwners on remote (only?)
frames do not have a detach, meaning that m_owner will be non-null during
finalization. Retired the Oilpan-only assert.

+}
+
+void Frame::dispose()
+{
+#if !ENABLE(OILPAN)

[dcheng, 2014/09/07 22:26:33]

Why is this block no longer needed with Oilpan? It seems like we'll be missing a
call to setDOMWindow(nullptr) now when the embedder explicitly invokes close().

[sof, 2014/09/08 21:17:45]

It is handled implicitly upon the next GC; LocalDOMWindow will have its
(Local)Frame* reference cleared as it is a weak member. Should the Frame and its
attached LocalDOMWindow die at the same time, it would be unsafe to attempt to
access m_domWindow from this finalizer..but it would be redundant in that case.

     disconnectOwnerElement();
     setDOMWindow(nullptr);
-
-    // FIXME: We should not be doing all this work inside the destructor
+#endif
 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 }
 
+void Frame::trace(Visitor* visitor)
+{
+    visitor->trace(m_treeNode);
+    visitor->trace(m_owner);
+    visitor->trace(m_domWindow);
+}
+
 void Frame::detachChildren()
 {
-    typedef Vector<RefPtr<Frame> > FrameVector;
+    typedef WillBeHeapVector<RefPtrWillBeMember<Frame> > FrameVector;
     FrameVector childrenToDetach;
     childrenToDetach.reserveCapacity(tree().childCount());
     for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling())
         childrenToDetach.append(child);
     FrameVector::iterator end = childrenToDetach.end();
     for (FrameVector::iterator it = childrenToDetach.begin(); it != end; ++it)
         (*it)->detach();
 }
 
 FrameHost* Frame::host() const
@@ skipping 12 matching lines @@
 {
     if (m_host)
         return &m_host->settings();
     return 0;
 }
 
 void Frame::setDOMWindow(PassRefPtrWillBeRawPtr<LocalDOMWindow> domWindow)
 {
     if (m_domWindow)
         m_domWindow->reset();
+
     m_domWindow = domWindow;
 }
 
 static ChromeClient& emptyChromeClient()
 {
     DEFINE_STATIC_LOCAL(EmptyChromeClient, client, ());
     return client;
 }
 
 ChromeClient& Frame::chromeClient() const
@@ skipping 12 matching lines @@
         return 0;
     // FIXME: If <object> is ever fixed to disassociate itself from frames
     // that it has started but canceled, then this can turn into an ASSERT
     // since ownerElement() would be 0 when the load is canceled.
     // https://bugs.webkit.org/show_bug.cgi?id=18585
     if (!object->isRenderPart())
         return 0;
     return toRenderPart(object);
 }
 
-void Frame::setRemotePlatformLayer(blink::WebLayer* layer)
+void Frame::setRemotePlatformLayer(WebLayer* layer)
 {
     if (m_remotePlatformLayer)
         GraphicsLayer::unregisterContentsLayer(m_remotePlatformLayer);
     m_remotePlatformLayer = layer;
     if (m_remotePlatformLayer)
         GraphicsLayer::registerContentsLayer(layer);
 
     ASSERT(owner());
     toHTMLFrameOwnerElement(owner())->setNeedsCompositingUpdate();
     if (RenderPart* renderer = ownerRenderer())
@@ skipping 18 matching lines @@
 }
 
 void Frame::disconnectOwnerElement()
 {
     if (m_owner) {
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->clearContentFrame();
         if (page())
             page()->decrementSubframeCount();
     }
-    m_owner = 0;
+    m_owner = nullptr;
 }
 
 HTMLFrameOwnerElement* Frame::deprecatedLocalOwner() const
 {
     return m_owner && m_owner->isLocal() ? toHTMLFrameOwnerElement(m_owner) : 0;
 }
 
 } // namespace blink