Move the Widget hierarchy to the Oilpan heap.

Source/web/WebPluginContainerImpl.h

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 36 matching lines @@
 namespace blink {
 
 class GestureEvent;
 class HTMLPlugInElement;
 class IntRect;
 class KeyboardEvent;
 class MouseEvent;
 class PlatformGestureEvent;
 class ResourceError;
 class ResourceResponse;
+class ScriptController;
 class ScrollbarGroup;
 class TouchEvent;
 class WebPlugin;
 class WebPluginLoadObserver;
 class WebExternalTextureLayer;
 class WheelEvent;
 class Widget;
 struct WebPrintParams;
 
-class WebPluginContainerImpl FINAL
-    : public PluginView
-    , public WebPluginContainer
-#if !ENABLE(OILPAN)
-    , public FrameDestructionObserver
-#endif
+class WebPluginContainerImpl FINAL : public PluginView, public WebPluginContainer, public FrameDestructionObserver {
+    WILL_BE_USING_GARBAGE_COLLECTED_MIXIN(WebPluginContainerImpl);
+public:
+    static PassRefPtrWillBeRawPtr<WebPluginContainerImpl> create(HTMLPlugInElement* element, WebPlugin* webPlugin)
     {
-public:
-    static PassRefPtr<WebPluginContainerImpl> create(HTMLPlugInElement* element, WebPlugin* webPlugin)
-    {
-        return adoptRef(new WebPluginContainerImpl(element, webPlugin));
+        return adoptRefWillBeNoop(new WebPluginContainerImpl(element, webPlugin));
     }
 
     // PluginView methods
     virtual WebLayer* platformLayer() const OVERRIDE;
     virtual v8::Local<v8::Object> scriptableObject(v8::Isolate*) OVERRIDE;
     virtual bool getFormValue(String&) OVERRIDE;
     virtual bool supportsKeyboardFocus() const OVERRIDE;
     virtual bool supportsInputMethod() const OVERRIDE;
     virtual bool canProcessDrag() const OVERRIDE;
     virtual bool wantsWheelEvents() OVERRIDE;
@@ skipping 75 matching lines @@
 
     void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
 
     ScrollbarGroup* scrollbarGroup();
 
     void willStartLiveResize();
     void willEndLiveResize();
 
     bool paintCustomOverhangArea(GraphicsContext*, const IntRect&, const IntRect&, const IntRect&);
 
-#if ENABLE(OILPAN)
-    virtual void detach() OVERRIDE;
-#endif
+    virtual void trace(Visitor*) OVERRIDE;
+    virtual void dispose() OVERRIDE;
 
 private:
     WebPluginContainerImpl(HTMLPlugInElement*, WebPlugin*);
     virtual ~WebPluginContainerImpl();
 
     void handleMouseEvent(MouseEvent*);
     void handleDragEvent(MouseEvent*);
     void handleWheelEvent(WheelEvent*);
     void handleKeyboardEvent(KeyboardEvent*);
     void handleTouchEvent(TouchEvent*);
     void handleGestureEvent(GestureEvent*);
 
     void synthesizeMouseEventIfPossible(TouchEvent*);
 
     void focusPlugin();
 
     void calculateGeometry(
         const IntRect& frameRect,
         IntRect& windowRect,
         IntRect& clipRect,
         Vector<IntRect>& cutOutRects);
     IntRect windowClipRect() const;
     void windowCutOutRects(
         const IntRect& frameRect,
         Vector<IntRect>& cutOutRects);
 
-#if ENABLE(OILPAN)
-    // FIXME: Oilpan: consider moving Widget to the heap, allowing this
-    // container object to be a FrameDestructionObserver. And thereby
-    // keep a traced member reference to the frame rather than as a
-    // bare pointer. Instead, the owning object (HTMLFrameOwnerElement)
-    // explicitly deletes this object when it is disconnected from its
-    // frame. Any access to an invalid frame via this bare pointer
-    // is therefore not possible.
+    // Oilpan: this is kept as a bare pointer to support renderer-less
+    // persisted plugins and their finalization. To handle that
+    // step correctly, an untraced reference is kept; see
+    // HTMLPlugInElement::m_persistedPluginWidget comment.
     //
-    // See the HTMLFrameOwnerElement::disconnectContentFrame comment for
-    // (even) more.
-    LocalFrame* m_frame;
-
-    LocalFrame* frame() const { return m_frame; }
-#endif
-
-    // FIXME: see above; for the time being, a bare pointer to the owning
-    // HTMLPlugInElement and managed as such.
+    // Note: using a traced Member<> would create a direct cycle
+    // with m_persistedPluginWidget, hence not done. A weak member
+    // is an alternative, but it is not unsafe to use a bare pointer.
     HTMLPlugInElement* m_element;
     WebPlugin* m_webPlugin;
     Vector<WebPluginLoadObserver*> m_pluginLoadObservers;
 
     WebLayer* m_webLayer;
 
     // The associated scrollbar group object, created lazily. Used for Pepper
     // scrollbars.
     OwnPtr<ScrollbarGroup> m_scrollbarGroup;
 
     TouchEventRequestType m_touchEventRequestType;
     bool m_wantsWheelEvents;
 };
 
 DEFINE_TYPE_CASTS(WebPluginContainerImpl, Widget, widget, widget->isPluginContainer(), widget.isPluginContainer());
 // Unlike Widget, we need not worry about object type for container.
 // WebPluginContainerImpl is the only subclass of WebPluginContainer.
 DEFINE_TYPE_CASTS(WebPluginContainerImpl, WebPluginContainer, container, true, true);
 
 } // namespace blink
 
 #endif