Move Frame to the Oilpan heap.

Source/web/WebLocalFrameImpl.cpp

Index: Source/web/WebLocalFrameImpl.cpp
diff --git a/Source/web/WebLocalFrameImpl.cpp b/Source/web/WebLocalFrameImpl.cpp
index 89c0f95edc455d40617cc63c39af7815041e7215..f3b1cda077d12fbc2536a409af88240540119d61 100644
--- a/Source/web/WebLocalFrameImpl.cpp
+++ b/Source/web/WebLocalFrameImpl.cpp
@@ -498,7 +498,15 @@ void WebLocalFrameImpl::close()
 {
     m_client = 0;
 
+    if (m_frame)
+        m_frame->setHasBeenClosed();
+
+#if ENABLE(OILPAN)
+    if (m_frame && m_frame->isMainFrame() && viewImpl())

[dcheng, 2014/09/17 10:58:08]

I'm a little concerned about how it's much harder to reason about memory
correctness in the Oilpan version of this code.

Before, the ownership model was very simple--Source/web internally holds a ref
on behalf of the embedder, which it drops once close() is called. The embedder
knows that as long as it doesn't call close(), the WebFrame remains live, no
matter what it does.

With Oilpan, the only reference the Blink API holds on behalf of the embedder is
for the main frame. As part of frame detach, the embedder (RenderFrameImpl)
removes child WebFrames from the frame tree. Today, the code for
RenderFrameImpl::frameDetached(WebFrame* frame) looks like this:

1798  if (is_subframe)
1799    frame->parent()->removeChild(frame);
1800
1801  // |frame| is invalid after here.
1802  frame->close();

Imagine that |frame| wasn't passed as a parameter to this method, and it was
using |frame_| instead (something that's likely to happen in the future). After
the call to removeChild(), I don't think there would actually be any references
to keep this child WebFrame alive. While this isn't technically an issue
(because I don't think a GC can run between line 1799 and 1802), it seems
conceptually wrong.

+        viewImpl()->clearMainFrame(this);
+#else
     deref(); // Balances ref() acquired in WebFrame::create
+#endif
 }
 
 WebString WebLocalFrameImpl::uniqueName() const
@@ -1527,7 +1535,12 @@ WebLocalFrame* WebLocalFrame::create(WebFrameClient* client)
 
 WebLocalFrameImpl* WebLocalFrameImpl::create(WebFrameClient* client)
 {
-    return adoptRef(new WebLocalFrameImpl(client)).leakRef();
+    WebLocalFrameImpl* frame = new WebLocalFrameImpl(client);
+#if ENABLE(OILPAN)
+    return frame;
+#else
+    return adoptRef(frame).leakRef();
+#endif
 }
 
 WebLocalFrameImpl::WebLocalFrameImpl(WebFrameClient* client)
@@ -1550,7 +1563,18 @@ WebLocalFrameImpl::~WebLocalFrameImpl()
     cancelPendingScopingEffort();
 }
 
-void WebLocalFrameImpl::setCoreFrame(PassRefPtr<LocalFrame> frame)
+void WebLocalFrameImpl::trace(Visitor* visitor)
+{
+#if ENABLE(OILPAN)
+    visitor->trace(m_frame);
+    visitor->trace(m_printContext);
+    visitor->trace(m_geolocationClientProxy);
+
+    WebFrame::traceChildren(visitor, this);
+#endif
+}
+
+void WebLocalFrameImpl::setCoreFrame(PassRefPtrWillBeRawPtr<LocalFrame> frame)
 {
     m_frame = frame;
 
@@ -1573,9 +1597,9 @@ void WebLocalFrameImpl::setCoreFrame(PassRefPtr<LocalFrame> frame)
     }
 }
 
-PassRefPtr<LocalFrame> WebLocalFrameImpl::initializeCoreFrame(FrameHost* host, FrameOwner* owner, const AtomicString& name, const AtomicString& fallbackName)
+PassRefPtrWillBeRawPtr<LocalFrame> WebLocalFrameImpl::initializeCoreFrame(FrameHost* host, FrameOwner* owner, const AtomicString& name, const AtomicString& fallbackName)
 {
-    RefPtr<LocalFrame> frame = LocalFrame::create(&m_frameLoaderClientImpl, host, owner);
+    RefPtrWillBeRawPtr<LocalFrame> frame = LocalFrame::create(&m_frameLoaderClientImpl, host, owner);
     setCoreFrame(frame);
     frame->tree().setName(name, fallbackName);
     // We must call init() after m_frame is assigned because it is referenced
@@ -1585,7 +1609,7 @@ PassRefPtr<LocalFrame> WebLocalFrameImpl::initializeCoreFrame(FrameHost* host, F
     return frame;
 }
 
-PassRefPtr<LocalFrame> WebLocalFrameImpl::createChildFrame(const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
+PassRefPtrWillBeRawPtr<LocalFrame> WebLocalFrameImpl::createChildFrame(const FrameLoadRequest& request, HTMLFrameOwnerElement* ownerElement)
 {
     ASSERT(m_client);
     WebLocalFrameImpl* webframeChild = toWebLocalFrameImpl(m_client->createChildFrame(this, request.frameName()));
@@ -1596,7 +1620,7 @@ PassRefPtr<LocalFrame> WebLocalFrameImpl::createChildFrame(const FrameLoadReques
     // solution. subResourceAttributeName returns just one attribute name. The
     // element might not have the attribute, and there might be other attributes
     // which can identify the element.
-    RefPtr<LocalFrame> child = webframeChild->initializeCoreFrame(frame()->host(), ownerElement, request.frameName(), ownerElement->getAttribute(ownerElement->subResourceAttributeName()));
+    RefPtrWillBeRawPtr<LocalFrame> child = webframeChild->initializeCoreFrame(frame()->host(), ownerElement, request.frameName(), ownerElement->getAttribute(ownerElement->subResourceAttributeName()));
     // Initializing the core frame may cause the new child to be detached, since
     // it may dispatch a load event in the parent.
     if (!child->tree().parent())