Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 60 matching lines @@
     , m_usePlaceholderContent(false)
 {
     setHasCustomStyleCallbacks();
 }
 
 HTMLPlugInElement::~HTMLPlugInElement()
 {
     ASSERT(!m_pluginWrapper); // cleared in detach()
     ASSERT(!m_isDelayingLoadEvent);
 
+#if ENABLE(OILPAN)
+    if (m_persistedPluginWidget)
+        HTMLFrameOwnerElement::disposeWidget(m_persistedPluginWidget.get());

[haraken, 2014/09/29 14:16:36]

Can't we call HTMLFrameOwnerElement::disposeWidget when the HTMLPlugInElement is
removed from the DOM tree?

Ideally we want to call disposeWidget in HTMLPlugInElement::removedFrom() if the
Widget dies before the HTMLPlugInElement, and don't call anything if the Widget
and the HTMLPlugInElement die together.

Then we want to make m_persistedPluginWidget a Member<Widget>.

I wonder what prevents us from doing something like that.

[sof, 2014/10/07 13:27:32]

That the plugin element isn't in the tree to start with :-) i.e., we can create
a plugin element outside the tree and load a renderer-less plugin.

See plugins/can-create-without-renderer.html for an example.

The disposal steps you refer to is set up to happen here in this CL if the
plugin element is attached to tree, I think (see
HTMLPlugInElement::disconnectContentFrame().)

+#endif
+
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
         m_NPObject = 0;
     }
 }
 
 void HTMLPlugInElement::trace(Visitor* visitor)
 {
     visitor->trace(m_imageLoader);
+    visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void HTMLPlugInElement::disconnectContentFrame()
+{
+    if (m_persistedPluginWidget)
+        HTMLFrameOwnerElement::disposeWidget(m_persistedPluginWidget.get());
+    HTMLFrameOwnerElement::disconnectContentFrame();
+}
+#endif
+
 bool HTMLPlugInElement::canProcessDrag() const
 {
     return pluginWidget() && pluginWidget()->isPluginView() && toPluginView(pluginWidget())->canProcessDrag();
 }
 
 bool HTMLPlugInElement::willRespondToMouseClickEvents()
 {
     if (isDisabledFormControl())
         return false;
     RenderObject* r = renderer();
@@ skipping 233 matching lines @@
     // FIXME: Mouse down and scroll events are passed down to plug-in via custom
     // code in EventHandler; these code paths should be united.
 
     RenderObject* r = renderer();
     if (!r || !r->isWidget())
         return;
     if (r->isEmbeddedObject()) {
         if (toRenderEmbeddedObject(r)->showsUnavailablePluginIndicator())
             return;
     }
-    RefPtr<Widget> widget = toRenderWidget(r)->widget();
+    RefPtrWillBeRawPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
     if (event->defaultHandled())
         return;
     HTMLFrameOwnerElement::defaultEventHandler(event);
 }
 
 RenderWidget* HTMLPlugInElement::renderWidgetForJSBindings() const
 {
@@ skipping 119 matching lines @@
 
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     // FIXME: This code should not depend on renderer!
     if ((!renderer && requireRenderer) || useFallback)
         return false;
 
     WTF_LOG(Plugins, "%p Plug-in URL: %s", this, m_url.utf8().data());
     WTF_LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
-    RefPtr<Widget> widget = m_persistedPluginWidget;
+    RefPtrWillBeRawPtr<Widget> widget = m_persistedPluginWidget;
     if (!widget) {
         bool loadManually = document().isPluginDocument() && !document().containsPlugins();
         FrameLoaderClient::DetachedPluginPolicy policy = requireRenderer ? FrameLoaderClient::FailOnDetachedPlugin : FrameLoaderClient::AllowDetachedPlugin;
         widget = frame->loader().client()->createPlugin(this, url, paramNames, paramValues, mimeType, loadManually, policy);
     }
 
     if (!widget) {
         if (renderer && !renderer->showsUnavailablePluginIndicator())
             renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginMissing);
         return false;
@@ skipping 95 matching lines @@
 
 void HTMLPlugInElement::setUsePlaceholderContent(bool use)
 {
     if (use != m_usePlaceholderContent) {
         m_usePlaceholderContent = use;
         lazyReattachIfAttached();
     }
 }
 
 }