Move Frame to the Oilpan heap.

Source/core/frame/DOMWindowProperty.cpp

Index: Source/core/frame/DOMWindowProperty.cpp
diff --git a/Source/core/frame/DOMWindowProperty.cpp b/Source/core/frame/DOMWindowProperty.cpp
index abb1abf010c35a3420ad7bd9e9f6bb29df048390..f9c8118fb684e4c396f84f14edef590540ff810b 100644
--- a/Source/core/frame/DOMWindowProperty.cpp
+++ b/Source/core/frame/DOMWindowProperty.cpp
@@ -34,25 +34,27 @@ namespace blink {
 
 DOMWindowProperty::DOMWindowProperty(LocalFrame* frame)
     : m_frame(frame)
-    , m_associatedDOMWindow(0)
+    , m_associatedDOMWindow(nullptr)
 {
     // FIXME: For now it *is* acceptable for a DOMWindowProperty to be created with a null frame.
     // See fast/dom/navigator-detached-no-crash.html for the recipe.
     // We should fix that.  <rdar://problem/11567132>
-    if (m_frame) {
+    if (this->frame()) {

[haraken, 2014/09/08 07:25:57]

What is this change for?

[sof, 2014/09/08 21:17:45]

Reverted back (a leftover from an experiment to see what it would take to make
m_frame a private across the codebase.)

         m_associatedDOMWindow = m_frame->domWindow();
         m_associatedDOMWindow->registerProperty(this);
     }
 }
 
+#if !ENABLE(OILPAN)
 DOMWindowProperty::~DOMWindowProperty()

[haraken, 2014/09/08 07:25:57]

Is it guaranteed that willDestroyGlobalObjectInFrame is called before
DOMWindowProperty's destructor is called?

If yes, let's add ASSERT(!m_frame).

If no, you'll need to change LocalDOMWindow::m_properties to a hash set of weak
members, so that the DOMWindowProperty gets removed from the hash set when the
DOMWindowProperty gets destructed.

[sof, 2014/09/08 21:17:45]

LocalDOMWindow::reset() calls willDestroyGlobalObjectInFrame() and is not
guaranteed to be called with Oilpan.

As DOMWindowProperty and LocalDOMWindow keep strong references to one another, I
don't see the need to do what you suggest. The m_frame reference is a weak one,
so it'll be cleared for the DOMWindowProperty (as it will be for the
FrameDestructionObserver-derived LocalDOMWindow.)

As it is now, ~DOMWindowProperty has no destructor with Oilpan. I hope we can
remove some upstream *Finalized uses as a result (but haven't looked into
details yet.)

 {
     if (m_associatedDOMWindow)
         m_associatedDOMWindow->unregisterProperty(this);
 
-    m_associatedDOMWindow = 0;
-    m_frame = 0;
+    m_associatedDOMWindow = nullptr;
+    m_frame = nullptr;
 }
+#endif
 
 void DOMWindowProperty::willDestroyGlobalObjectInFrame()
 {
@@ -64,8 +66,8 @@ void DOMWindowProperty::willDestroyGlobalObjectInFrame()
     // itself from any LocalDOMWindow it is associated with if that LocalDOMWindow is going away.
     if (m_associatedDOMWindow)
         m_associatedDOMWindow->unregisterProperty(this);
-    m_associatedDOMWindow = 0;
-    m_frame = 0;
+    m_associatedDOMWindow = nullptr;
+    m_frame = nullptr;
 }
 
 void DOMWindowProperty::willDetachGlobalObjectFromFrame()
@@ -75,4 +77,10 @@ void DOMWindowProperty::willDetachGlobalObjectFromFrame()
     ASSERT(m_associatedDOMWindow);
 }
 
+void DOMWindowProperty::trace(Visitor* visitor)
+{
+    visitor->trace(m_frame);
+    visitor->trace(m_associatedDOMWindow);
+}
+
 }