Move Frame to the Oilpan heap.

Source/core/frame/LocalDOMWindow.cpp

Index: Source/core/frame/LocalDOMWindow.cpp
diff --git a/Source/core/frame/LocalDOMWindow.cpp b/Source/core/frame/LocalDOMWindow.cpp
index 382992a463e93ed1aa765b3d3077dfc2037fc4d8..db01143b077dc0fe6beb0b28a25945e08a228b09 100644
--- a/Source/core/frame/LocalDOMWindow.cpp
+++ b/Source/core/frame/LocalDOMWindow.cpp
@@ -483,7 +483,7 @@ void LocalDOMWindow::enqueuePopstateEvent(PassRefPtr<SerializedScriptValue> stat
 
 void LocalDOMWindow::statePopped(PassRefPtr<SerializedScriptValue> stateObject)
 {
-    if (!frame())
+    if (!m_frame)
         return;
 
     // Per step 11 of section 6.5.9 (history traversal) of the HTML5 spec, we
@@ -496,8 +496,6 @@ void LocalDOMWindow::statePopped(PassRefPtr<SerializedScriptValue> stateObject)
 
 LocalDOMWindow::~LocalDOMWindow()
 {
-    ASSERT(m_hasBeenReset);
-
 #if ENABLE(OILPAN)
     // Oilpan: the frame host and document objects are
     // also garbage collected; cannot notify these
@@ -507,6 +505,7 @@ LocalDOMWindow::~LocalDOMWindow()
     // Cleared when detaching document.
     ASSERT(!m_eventQueue);
 #else
+    ASSERT(m_hasBeenReset);
     reset();
 
     removeAllEventListenersInternal(DoBroadcastListenerRemoval);
@@ -541,11 +540,13 @@ Page* LocalDOMWindow::page()
     return frame() ? frame()->page() : 0;
 }
 
+#if !ENABLE(OILPAN)
 void LocalDOMWindow::frameDestroyed()
 {
     FrameDestructionObserver::frameDestroyed();
     reset();

[haraken, 2014/09/11 14:47:25]

Sorry for asking a similar question (c.f.,
https://codereview.chromium.org/517043003/diff/260001/Source/core/frame/Local...):

Why is it OK not to call reset() in the weak processing of
LocalDOMWindow::m_frame? In non-oilpan reset() is called when the Frame is
destructed. I guess that in oilpan reset() needs to be called as well when the
Frame is weak-processed.

[sof, 2014/09/12 17:08:40]

I think calling reset() at all here is questionable, non-Oilpan :-)

i.e., detaching a window from its frame shouldn't remove the dependent objects
(e.g., window.location) and their wrappers. If try accessing window.location
(say) afterwards, a new object will be created, but with a different wrapper.

https://codereview.chromium.org/565243002/ is what I suggest we do for
non-Oilpan instead. By doing so, there would be no extra reset() weak processing
step needed here. wdyt?

[sof, 2014/09/14 06:48:48]

There's actually no need to do any resetting here, as the frame will alreadly
have done as part of clearing its window reference during finalization.

Removed the call, but left an assert.

 }
+#endif
 
 void LocalDOMWindow::willDetachFrameHost()
 {
@@ -896,7 +897,7 @@ void LocalDOMWindow::dispatchMessageEventWithOriginCheck(SecurityOrigin* intende
 
 DOMSelection* LocalDOMWindow::getSelection()
 {
-    if (!isCurrentlyDisplayedInFrame() || !m_frame)
+    if (!isCurrentlyDisplayedInFrame())
         return 0;
 
     return m_frame->document()->getSelection();
@@ -1054,8 +1055,8 @@ bool LocalDOMWindow::find(const String& string, bool caseSensitive, bool backwar
         return false;
 
     // |m_frame| can be destructed during |Editor::findString()| via
-    // |Document::updateLayou()|, e.g. event handler removes a frame.
-    RefPtr<LocalFrame> protectFrame(m_frame);
+    // |Document::updateLayout()|, e.g. event handler removes a frame.
+    RefPtrWillBeRawPtr<LocalFrame> protectFrame(m_frame.get());
 
     // FIXME (13016): Support wholeWord, searchInFrames and showDialog
     return m_frame->editor().findString(string, !backwards, caseSensitive, wrap, false);
@@ -1188,7 +1189,13 @@ int LocalDOMWindow::scrollY() const
 
 bool LocalDOMWindow::closed() const
 {
-    return !m_frame;
+    // FIXME: Oilpan: the timing of when m_frame is GCed is clearly
+    // different to what happens non-Oilpan. m_frame->hasBeenClosed()
+    // is considered in both settings to make the behavior the same --
+    // the flag is set when the WebView (and frame) is closed. Finalization
+    // of the m_frame will happen at some point later.
+    //
+    return !m_frame || m_frame->hasBeenClosed();
 }
 
 unsigned LocalDOMWindow::length() const
@@ -1857,11 +1864,10 @@ void LocalDOMWindow::showModalDialog(const String& urlString, const String& dial
 
 LocalDOMWindow* LocalDOMWindow::anonymousIndexedGetter(uint32_t index)
 {
-    LocalFrame* frame = this->frame();
-    if (!frame)
+    if (!m_frame)
         return 0;
 
-    Frame* child = frame->tree().scopedChild(index);
+    Frame* child = m_frame->tree().scopedChild(index);
     if (child)
         return child->domWindow();
 
@@ -1905,6 +1911,7 @@ void LocalDOMWindow::trace(Visitor* visitor)
     WillBeHeapSupplementable<LocalDOMWindow>::trace(visitor);
     EventTargetWithInlineData::trace(visitor);
     LifecycleContext<LocalDOMWindow>::trace(visitor);
+    FrameDestructionObserver::trace(visitor);
 }
 
 v8::Handle<v8::Object> LocalDOMWindow::wrap(v8::Handle<v8::Object> creationContext, v8::Isolate* isolate)