Move Frame to the Oilpan heap.

Source/core/page/EventHandler.cpp

Index: Source/core/page/EventHandler.cpp
diff --git a/Source/core/page/EventHandler.cpp b/Source/core/page/EventHandler.cpp
index b95b1f66f6fd24317f10be61ab00b92a7e0cd369..b8fba7253e9e64624e04e56f50fad3eb245ddec8 100644
--- a/Source/core/page/EventHandler.cpp
+++ b/Source/core/page/EventHandler.cpp
@@ -52,6 +52,7 @@
 #include "core/events/WheelEvent.h"
 #include "core/fetch/ImageResource.h"
 #include "core/frame/EventHandlerRegistry.h"
+#include "core/frame/FrameProtector.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/Settings.h"
@@ -243,6 +244,7 @@ void EventHandler::trace(Visitor* visitor)
     visitor->trace(m_capturingMouseEventsNode);
     visitor->trace(m_nodeUnderMouse);
     visitor->trace(m_lastNodeUnderMouse);
+    visitor->trace(m_lastMouseMoveEventSubframe);
     visitor->trace(m_clickNode);
     visitor->trace(m_dragTarget);
     visitor->trace(m_frameSetBeingResized);
@@ -1202,7 +1204,7 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
     TRACE_EVENT0("blink", "EventHandler::handleMousePressEvent");
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
 
     UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     m_frame->localFrameRoot()->eventHandler().m_lastMouseDownUserGestureToken = gestureIndicator.currentToken();
@@ -1241,8 +1243,9 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
-    RefPtr<LocalFrame> subframe = subframeForHitTestResult(mev);
-    if (subframe && passMousePressEventToSubframe(mev, subframe.get())) {
+    LocalFrame* subframe = subframeForHitTestResult(mev);
+    FrameProtector protect(subframe);
+    if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         // Start capturing future events for this frame.  We only do this if we didn't clear
         // the m_mousePressed flag, which may happen if an AppKit widget entered a modal event loop.
         m_capturesDragging = subframe->eventHandler().capturesDragging();
@@ -1346,7 +1349,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& event)
 {
     TRACE_EVENT0("blink", "EventHandler::handleMouseMoveEvent");
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
     MaximumDurationTracker maxDurationTracker(&m_maxMouseMovedDuration);
 
     HitTestResult hoveredNode = HitTestResult(LayoutPoint());
@@ -1375,7 +1378,7 @@ void EventHandler::handleMouseLeaveEvent(const PlatformMouseEvent& event)
 {
     TRACE_EVENT0("blink", "EventHandler::handleMouseLeaveEvent");
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
     handleMouseMoveOrLeaveEvent(event);
 }
 
@@ -1446,7 +1449,8 @@ bool EventHandler::handleMouseMoveOrLeaveEvent(const PlatformMouseEvent& mouseEv
     }
 
     bool swallowEvent = false;
-    RefPtr<LocalFrame> newSubframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
+    LocalFrame* newSubframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
+    FrameProtector protect(newSubframe);
 
     // We want mouseouts to happen first, from the inside out.  First send a move event to the last subframe so that it will fire mouseouts.
     if (m_lastMouseMoveEventSubframe && m_lastMouseMoveEventSubframe->tree().isDescendantOf(m_frame) && m_lastMouseMoveEventSubframe != newSubframe)
@@ -1459,7 +1463,7 @@ bool EventHandler::handleMouseMoveOrLeaveEvent(const PlatformMouseEvent& mouseEv
         // Event dispatch in updateMouseEventTargetNode may have caused the subframe of the target
         // node to be detached from its FrameView, in which case the event should not be passed.
         if (newSubframe->view())
-            swallowEvent |= passMouseMoveEventToSubframe(mev, newSubframe.get(), hoveredNode);
+            swallowEvent |= passMouseMoveEventToSubframe(mev, newSubframe, hoveredNode);
     } else {
         if (scrollbar && !m_mousePressed)
             scrollbar->mouseMoved(mouseEvent); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
@@ -1503,7 +1507,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 {
     TRACE_EVENT0("blink", "EventHandler::handleMouseReleaseEvent");
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
 
     m_frame->selection().setCaretBlinkingSuspended(false);
 
@@ -1957,7 +1961,7 @@ bool EventHandler::handleWheelEvent(const PlatformWheelEvent& event)
     if (!doc->renderView())
         return false;
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
 
     FrameView* view = m_frame->view();
     if (!view)
@@ -2082,8 +2086,9 @@ bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
     GestureEventWithHitTestResults targetedEvent = targetGestureEvent(gestureEvent);
 
     // Route to the correct frame.
-    if (LocalFrame* innerFrame = targetedEvent.hitTestResult().innerNodeFrame())
+    if (LocalFrame* innerFrame = targetedEvent.hitTestResult().innerNodeFrame()) {
         return innerFrame->eventHandler().handleGestureEventInFrame(targetedEvent);
+    }
 
     // No hit test result, handle in root instance. Perhaps we should just return false instead?
     return handleGestureEventInFrame(targetedEvent);
@@ -2205,7 +2210,8 @@ bool EventHandler::handleGestureScrollEvent(const PlatformGestureEvent& gestureE
 
 bool EventHandler::handleGestureTap(const GestureEventWithHitTestResults& targetedEvent)
 {
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
+
     const PlatformGestureEvent& gestureEvent = targetedEvent.event();
 
     UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
@@ -2298,7 +2304,8 @@ bool EventHandler::handleGestureLongPress(const GestureEventWithHitTestResults&
         m_mouseDownMayStartDrag = true;
         dragState().m_dragSrc = nullptr;
         m_mouseDownPos = m_frame->view()->windowToContents(mouseDragEvent.position());
-        RefPtr<FrameView> protector(m_frame->view());
+        FrameViewProtector protector(m_frame->view());
+
         handleDrag(mev, DontCheckDragHysteresis);
         if (m_didStartDrag) {
             m_longTapShouldInvokeContextMenu = true;
@@ -2432,7 +2439,7 @@ bool EventHandler::handleGestureScrollUpdate(const PlatformGestureEvent& gesture
     if (!renderer)
         return false;
 
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
 
     Node* stopNode = 0;
     bool scrollShouldNotPropagate = gestureEvent.type() == PlatformEvent::GestureScrollUpdateWithoutPropagation;
@@ -2989,7 +2996,7 @@ bool EventHandler::isKeyEventAllowedInFullScreen(Fullscreen* fullscreen, const P
 
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
-    RefPtr<FrameView> protector(m_frame->view());
+    FrameViewProtector protector(m_frame->view());
 
     ASSERT(m_frame->document());
     if (Fullscreen* fullscreen = Fullscreen::fromIfExists(*m_frame->document())) {