Move Frame to the Oilpan heap.

Source/core/html/HTMLFrameOwnerElement.cpp

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 80 matching lines @@
             parent->addChild(child);
         else if (toScrollView(child->parent()))
             toScrollView(child->parent())->removeChild(child);
         return;
     }
     widgetNewParentMap().set(child, parent);
 }
 
 HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document& document)
     : HTMLElement(tagName, document)
-    , m_contentFrame(0)
+    , m_contentFrame(nullptr)
     , m_widget(nullptr)
     , m_sandboxFlags(SandboxNone)
 {
 }
 
 RenderPart* HTMLFrameOwnerElement::renderPart() const
 {
     // HTMLObjectElement and HTMLEmbedElement may return arbitrary renderers
     // when using fallback content.
     if (!renderer() || !renderer()->isRenderPart())
@@ skipping 11 matching lines @@
 
     for (ContainerNode* node = this; node; node = node->parentOrShadowHostNode())
         node->incrementConnectedSubframeCount();
 }
 
 void HTMLFrameOwnerElement::clearContentFrame()
 {
     if (!m_contentFrame)
         return;
 
-    m_contentFrame = 0;
+    m_contentFrame = nullptr;
 
     for (ContainerNode* node = this; node; node = node->parentOrShadowHostNode())
         node->decrementConnectedSubframeCount();
 }
 
 void HTMLFrameOwnerElement::disconnectContentFrame()
 {
     // FIXME: Currently we don't do this in removedFrom because this causes an
     // unload event in the subframe which could execute script that could then
     // reach up into this document and then attempt to look back down. We should
     // see if this behavior is really needed as Gecko does not allow this.
-    if (Frame* frame = contentFrame()) {
-        RefPtr<Frame> protect(frame);
+    if (RefPtrWillBeRawPtr<Frame> frame = contentFrame()) {
         frame->detach();
+#if ENABLE(OILPAN)
+        // FIXME: Oilpan: the plugin container is released and finalized here
+        // in order to work around the current inability to make the plugin
+        // container a FrameDestructionObserver (it needs to effectively be on
+        // the heap, and Widget isn't). Hence, release it here while its
+        // frame reference is still valid.
+        //
+        // As yet unknown if we can "get away" with releasing it slightly earlier..

[Mads Ager (chromium), 2014/09/16 12:17:45]

How do we resolve this one? No tests failing I assume? Once we are happy with
the rest we should find the right person to ask about this.

[sof, 2014/09/17 09:42:58]

Yes, destruction shouldn't be far off regardless. No plugins/ tests, such as
they are, are suffering as a result.  

+        if (m_widget && m_widget->isPluginContainer())
+            m_widget = nullptr;
+#endif
         frame->disconnectOwnerElement();
     }
 }
 
 HTMLFrameOwnerElement::~HTMLFrameOwnerElement()
 {
+#if ENABLE(OILPAN)
+    // An owner must by now have been informed of detachment
+    // when the frame was closed.
+    ASSERT(!m_contentFrame);
+#else
     if (m_contentFrame)
         m_contentFrame->disconnectOwnerElement();
+#endif
 }
 
 Document* HTMLFrameOwnerElement::contentDocument() const
 {
     return (m_contentFrame && m_contentFrame->isLocalFrame()) ? toLocalFrame(m_contentFrame)->document() : 0;
 }
 
 LocalDOMWindow* HTMLFrameOwnerElement::contentWindow() const
 {
     return m_contentFrame ? m_contentFrame->domWindow() : 0;
@@ skipping 51 matching lines @@
         cache->childrenChanged(renderWidget);
 }
 
 Widget* HTMLFrameOwnerElement::ownedWidget() const
 {
     return m_widget.get();
 }
 
 bool HTMLFrameOwnerElement::loadOrRedirectSubframe(const KURL& url, const AtomicString& frameName, bool lockBackForwardList)
 {
-    RefPtr<LocalFrame> parentFrame = document().frame();
+    RefPtrWillBeRawPtr<LocalFrame> parentFrame = document().frame();
     // FIXME(kenrb): The necessary semantics for RemoteFrames have not been worked out yet, but this will likely need some logic to handle them.
     if (contentFrame() && contentFrame()->isLocalFrame()) {
         toLocalFrame(contentFrame())->navigationScheduler().scheduleLocationChange(&document(), url.string(), Referrer(document().outgoingReferrer(), document().referrerPolicy()), lockBackForwardList);
         return true;
     }
 
     if (!document().securityOrigin()->canDisplay(url)) {
         FrameLoader::reportLocalLoadFailed(parentFrame.get(), url.string());
         return false;
     }
 
     if (!SubframeLoadingDisabler::canLoadFrame(*this))
         return false;
 
     String referrer = SecurityPolicy::generateReferrerHeader(document().referrerPolicy(), url, document().outgoingReferrer());
     return parentFrame->loader().client()->createFrame(url, frameName, Referrer(referrer, document().referrerPolicy()), this);
 }
 
+void HTMLFrameOwnerElement::trace(Visitor* visitor)
+{
+    visitor->trace(m_contentFrame);
+    HTMLElement::trace(visitor);
+    FrameOwner::trace(visitor);
+}
+
 
 } // namespace blink