Oilpan: make DOMWindowProperty a GC mixin.

Source/core/loader/appcache/ApplicationCache.cpp

 /*
  * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 26 matching lines @@
 namespace blink {
 
 ApplicationCache::ApplicationCache(LocalFrame* frame)
     : DOMWindowProperty(frame)
 {
     ApplicationCacheHost* cacheHost = applicationCacheHost();
     if (cacheHost)
         cacheHost->setApplicationCache(this);
 }
 
+ApplicationCache::~ApplicationCache()
+{
+    ASSERT(!m_frame);
+#if ENABLE(OILPAN)
+    if (ApplicationCacheHost* cacheHost = applicationCacheHost())

[Mads Ager (chromium), 2014/09/09 12:09:44]

What makes sure that m_frame is alive at this point? It looks like m_frame is a
raw pointer, so it is not entirely clear to me if the m_frame access here is
safe.

How will this be dealt with when LocalFrame is garbage collected. At that point
I assume that we cannot access m_frame to get the cache host?

[sof, 2014/09/09 12:53:58]

Hmm, this dtor is problematic with Oilpan for two reasons:

 - there's no guarantee that m_frame will be cleared upon finalization, as the
DOMWindowProperty might not be notified.
 - And if it is, the appcache host cannot be accessed :)

There is a fair chance that the ApplicationCacheHost on a DocumentLoader dies at
the same time as the ApplicationCache it is connected to, but an unsafe
arrangement it is.

I've addressed this by moving ApplicationCacheHost to the heap & made its
appcache back-reference be weak.

Thanks for pointing out the problem here; brain freeze on my part.

+        cacheHost->setApplicationCache(0);
+#endif
+}
+
+void ApplicationCache::trace(Visitor* visitor)
+{
+    EventTargetWithInlineData::trace(visitor);
+    DOMWindowProperty::trace(visitor);
+}
+
 void ApplicationCache::willDestroyGlobalObjectInFrame()
 {
     if (ApplicationCacheHost* cacheHost = applicationCacheHost())
         cacheHost->setApplicationCache(0);
     DOMWindowProperty::willDestroyGlobalObjectInFrame();
 }
 
 ApplicationCacheHost* ApplicationCache::applicationCacheHost() const
 {
     if (!m_frame || !m_frame->loader().documentLoader())
@@ skipping 60 matching lines @@
     case ApplicationCacheHost::CACHED_EVENT:
         return EventTypeNames::cached;
     case ApplicationCacheHost::OBSOLETE_EVENT:
         return EventTypeNames::obsolete;
     }
     ASSERT_NOT_REACHED();
     return EventTypeNames::error;
 }
 
 } // namespace blink