Move Frame to the Oilpan heap.

Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 63 matching lines @@
         page()->incrementSubframeCount();
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->setContentFrame(*this);
     } else {
         page()->setMainFrame(this);
     }
 }
 
 Frame::~Frame()
 {
+    // FIXME: We should not be doing all this work inside the destructor
+#if !ENABLE(OILPAN)
     disconnectOwnerElement();
     setDOMWindow(nullptr);
-
-    // FIXME: We should not be doing all this work inside the destructor
+#endif

[haraken, 2014/09/22 05:35:22]

Just help me understand: We don't need to call disconnectOwnerElement() here
because disconnectOwnerElement() should have already been called when the Frame
is detached from the host, right?

Why can we remove setDOMWindow(nullptr)?

Can we add ASSERT(!m_owner) here?

[sof, 2014/09/22 08:41:51]

Yes, we assume so for local frames. For remote frames, see below.
For the same reason that it is acceptable not to do it for LocalFrame. i.e.,
there's no need to clear Members on the LocalDOMWindow & registered
DOMWindowProperty objects keep a weak Frame reference, so they'll be cleared (if
needed.)
We've covered this previously, this cannot be assumed for remote frames --
https://codereview.chromium.org/517043003/diff/260001/Source/core/frame/Frame...

There are ongoing changes elsewhere to frame detach (
https://codereview.chromium.org/551973005/ ); I'd like to see where that ends up
before investing any more time going after detach details.

[dcheng, 2014/09/22 09:15:04]

Hm. That seems inconsistent. If you don't mind, can you file a bug with label
Cr-Internals-Sandbox-SiteIsolation and assign it to me?

 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 }
 
+void Frame::trace(Visitor* visitor)
+{
+    visitor->trace(m_treeNode);
+    visitor->trace(m_host);
+    visitor->trace(m_owner);
+    visitor->trace(m_domWindow);
+}
+
 void Frame::detachChildren()
 {
-    typedef Vector<RefPtr<Frame> > FrameVector;
+    typedef WillBeHeapVector<RefPtrWillBeMember<Frame> > FrameVector;
     FrameVector childrenToDetach;
     childrenToDetach.reserveCapacity(tree().childCount());
     for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling())
         childrenToDetach.append(child);
     FrameVector::iterator end = childrenToDetach.end();
     for (FrameVector::iterator it = childrenToDetach.begin(); it != end; ++it)
         (*it)->detach();
 }
 
 FrameHost* Frame::host() const
@@ skipping 12 matching lines @@
 {
     if (m_host)
         return &m_host->settings();
     return 0;
 }
 
 void Frame::setDOMWindow(PassRefPtrWillBeRawPtr<LocalDOMWindow> domWindow)
 {
     if (m_domWindow)
         m_domWindow->reset();
+
     m_domWindow = domWindow;
 }
 
 static ChromeClient& emptyChromeClient()
 {
     DEFINE_STATIC_LOCAL(EmptyChromeClient, client, ());
     return client;
 }
 
 ChromeClient& Frame::chromeClient() const
@@ skipping 12 matching lines @@
         return 0;
     // FIXME: If <object> is ever fixed to disassociate itself from frames
     // that it has started but canceled, then this can turn into an ASSERT
     // since ownerElement() would be 0 when the load is canceled.
     // https://bugs.webkit.org/show_bug.cgi?id=18585
     if (!object->isRenderPart())
         return 0;
     return toRenderPart(object);
 }
 
-void Frame::setRemotePlatformLayer(blink::WebLayer* layer)
+void Frame::setRemotePlatformLayer(WebLayer* layer)
 {
     if (m_remotePlatformLayer)
         GraphicsLayer::unregisterContentsLayer(m_remotePlatformLayer);
     m_remotePlatformLayer = layer;
     if (m_remotePlatformLayer)
         GraphicsLayer::registerContentsLayer(layer);
 
     ASSERT(owner());
     toHTMLFrameOwnerElement(owner())->setNeedsCompositingUpdate();
     if (RenderPart* renderer = ownerRenderer())
@@ skipping 18 matching lines @@
 }
 
 void Frame::disconnectOwnerElement()
 {
     if (m_owner) {
         if (m_owner->isLocal())
             toHTMLFrameOwnerElement(m_owner)->clearContentFrame();
         if (page())
             page()->decrementSubframeCount();
     }
-    m_owner = 0;
+    m_owner = nullptr;
 }
 
 HTMLFrameOwnerElement* Frame::deprecatedLocalOwner() const
 {
     return m_owner && m_owner->isLocal() ? toHTMLFrameOwnerElement(m_owner) : 0;
 }
 
 } // namespace blink