Oilpan: make DOMWindowProperty a GC mixin.

Source/core/loader/appcache/ApplicationCache.cpp

Index: Source/core/loader/appcache/ApplicationCache.cpp
diff --git a/Source/core/loader/appcache/ApplicationCache.cpp b/Source/core/loader/appcache/ApplicationCache.cpp
index ad15b38e528c743ba2e6f590c69b5a9053e8fb7c..306b7bbbf68ab01da63ce2eac00bea5fea54c88d 100644
--- a/Source/core/loader/appcache/ApplicationCache.cpp
+++ b/Source/core/loader/appcache/ApplicationCache.cpp
@@ -44,6 +44,21 @@ ApplicationCache::ApplicationCache(LocalFrame* frame)
         cacheHost->setApplicationCache(this);
 }
 
+ApplicationCache::~ApplicationCache()
+{
+    ASSERT(!m_frame);
+#if ENABLE(OILPAN)
+    if (ApplicationCacheHost* cacheHost = applicationCacheHost())

[Mads Ager (chromium), 2014/09/09 12:09:44]

What makes sure that m_frame is alive at this point? It looks like m_frame is a
raw pointer, so it is not entirely clear to me if the m_frame access here is
safe.

How will this be dealt with when LocalFrame is garbage collected. At that point
I assume that we cannot access m_frame to get the cache host?

[sof, 2014/09/09 12:53:58]

Hmm, this dtor is problematic with Oilpan for two reasons:

 - there's no guarantee that m_frame will be cleared upon finalization, as the
DOMWindowProperty might not be notified.
 - And if it is, the appcache host cannot be accessed :)

There is a fair chance that the ApplicationCacheHost on a DocumentLoader dies at
the same time as the ApplicationCache it is connected to, but an unsafe
arrangement it is.

I've addressed this by moving ApplicationCacheHost to the heap & made its
appcache back-reference be weak.

Thanks for pointing out the problem here; brain freeze on my part.

+        cacheHost->setApplicationCache(0);
+#endif
+}
+
+void ApplicationCache::trace(Visitor* visitor)
+{
+    EventTargetWithInlineData::trace(visitor);
+    DOMWindowProperty::trace(visitor);
+}
+
 void ApplicationCache::willDestroyGlobalObjectInFrame()
 {
     if (ApplicationCacheHost* cacheHost = applicationCacheHost())