Move Frame to the Oilpan heap.

Source/core/frame/Frame.cpp

Index: Source/core/frame/Frame.cpp
diff --git a/Source/core/frame/Frame.cpp b/Source/core/frame/Frame.cpp
index f647b3e5988b5ed202236a17a12183a39112612d..ccd11f64b473381f03b898d94647e4b0cf61927e 100644
--- a/Source/core/frame/Frame.cpp
+++ b/Source/core/frame/Frame.cpp
@@ -81,19 +81,28 @@ Frame::Frame(FrameClient* client, FrameHost* host, FrameOwner* owner)
 
 Frame::~Frame()
 {
+    // FIXME: We should not be doing all this work inside the destructor
+#if !ENABLE(OILPAN)
     disconnectOwnerElement();
     setDOMWindow(nullptr);
-
-    // FIXME: We should not be doing all this work inside the destructor
+#endif

[haraken, 2014/09/22 05:35:22]

Just help me understand: We don't need to call disconnectOwnerElement() here
because disconnectOwnerElement() should have already been called when the Frame
is detached from the host, right?

Why can we remove setDOMWindow(nullptr)?

Can we add ASSERT(!m_owner) here?

[sof, 2014/09/22 08:41:51]

Yes, we assume so for local frames. For remote frames, see below.
For the same reason that it is acceptable not to do it for LocalFrame. i.e.,
there's no need to clear Members on the LocalDOMWindow & registered
DOMWindowProperty objects keep a weak Frame reference, so they'll be cleared (if
needed.)
We've covered this previously, this cannot be assumed for remote frames --
https://codereview.chromium.org/517043003/diff/260001/Source/core/frame/Frame...

There are ongoing changes elsewhere to frame detach (
https://codereview.chromium.org/551973005/ ); I'd like to see where that ends up
before investing any more time going after detach details.

[dcheng, 2014/09/22 09:15:04]

Hm. That seems inconsistent. If you don't mind, can you file a bug with label
Cr-Internals-Sandbox-SiteIsolation and assign it to me?

 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 }
 
+void Frame::trace(Visitor* visitor)
+{
+    visitor->trace(m_treeNode);
+    visitor->trace(m_host);
+    visitor->trace(m_owner);
+    visitor->trace(m_domWindow);
+}
+
 void Frame::detachChildren()
 {
-    typedef Vector<RefPtr<Frame> > FrameVector;
+    typedef WillBeHeapVector<RefPtrWillBeMember<Frame> > FrameVector;
     FrameVector childrenToDetach;
     childrenToDetach.reserveCapacity(tree().childCount());
     for (Frame* child = tree().firstChild(); child; child = child->tree().nextSibling())
@@ -126,6 +135,7 @@ void Frame::setDOMWindow(PassRefPtrWillBeRawPtr<LocalDOMWindow> domWindow)
 {
     if (m_domWindow)
         m_domWindow->reset();
+
     m_domWindow = domWindow;
 }
 
@@ -158,7 +168,7 @@ RenderPart* Frame::ownerRenderer() const
     return toRenderPart(object);
 }
 
-void Frame::setRemotePlatformLayer(blink::WebLayer* layer)
+void Frame::setRemotePlatformLayer(WebLayer* layer)
 {
     if (m_remotePlatformLayer)
         GraphicsLayer::unregisterContentsLayer(m_remotePlatformLayer);
@@ -197,7 +207,7 @@ void Frame::disconnectOwnerElement()
         if (page())
             page()->decrementSubframeCount();
     }
-    m_owner = 0;
+    m_owner = nullptr;
 }
 
 HTMLFrameOwnerElement* Frame::deprecatedLocalOwner() const