Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/FrameView.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Dirk Mueller <mueller@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *           (C) 2006 Graham Dennis (graham.dennis@gmail.com)
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
@@ skipping 104 matching lines @@
     , m_viewportRenderer(0)
     , m_wasScrolledByUser(false)
     , m_inProgrammaticScroll(false)
     , m_safeToPropagateScrollToParent(true)
     , m_isTrackingPaintInvalidations(false)
     , m_scrollCorner(nullptr)
     , m_visibleContentScaleFactor(1)
     , m_inputEventsScaleFactorForEmulation(1)
     , m_layoutSizeFixedToFrameSize(true)
     , m_didScrollTimer(this, &FrameView::didScrollTimerFired)
+    , m_topControlsViewportAdjustment(0)
     , m_needsUpdateWidgetPositions(false)
-    , m_topControlsViewportAdjustment(0)
+#if ENABLE(OILPAN) && ENABLE(ASSERT)
+    , m_hasBeenDisposed(false)
+#endif
 {
     ASSERT(m_frame);
     init();
 
     if (!m_frame->isMainFrame())
         return;
 
     ScrollableArea::setVerticalScrollElasticity(ScrollElasticityAllowed);
     ScrollableArea::setHorizontalScrollElasticity(ScrollElasticityAllowed);
 }
 
-PassRefPtr<FrameView> FrameView::create(LocalFrame* frame)
+PassRefPtrWillBeRawPtr<FrameView> FrameView::create(LocalFrame* frame)
 {
-    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    RefPtrWillBeRawPtr<FrameView> view = adoptRefWillBeNoop(new FrameView(frame));
     view->show();
     return view.release();
 }
 
-PassRefPtr<FrameView> FrameView::create(LocalFrame* frame, const IntSize& initialSize)
+PassRefPtrWillBeRawPtr<FrameView> FrameView::create(LocalFrame* frame, const IntSize& initialSize)
 {
-    RefPtr<FrameView> view = adoptRef(new FrameView(frame));
+    RefPtrWillBeRawPtr<FrameView> view = adoptRefWillBeNoop(new FrameView(frame));
     view->Widget::setFrameRect(IntRect(view->location(), initialSize));
     view->setLayoutSizeInternal(initialSize);
 
     view->show();
     return view.release();
 }
 
 FrameView::~FrameView()
 {
+#if ENABLE(OILPAN)
+    ASSERT(m_hasBeenDisposed);
+#else
+    // Verify that the LocalFrame has a different FrameView or
+    // that it is being detached and destructed.
+    ASSERT(frame().view() != this || !renderView());
+    dispose();
+#endif
+}
+
+void FrameView::dispose()
+{
     if (m_postLayoutTasksTimer.isActive())
         m_postLayoutTasksTimer.stop();
 
     if (m_didScrollTimer.isActive())
         m_didScrollTimer.stop();
 
     removeFromAXObjectCache();
 
     // Custom scrollbars should already be destroyed at this point
     ASSERT(!horizontalScrollbar() || !horizontalScrollbar()->isCustomScrollbar());
     ASSERT(!verticalScrollbar() || !verticalScrollbar()->isCustomScrollbar());
 
     setHasHorizontalScrollbar(false); // Remove native scrollbars now before we lose the connection to the HostWindow.
     setHasVerticalScrollbar(false);
 
     ASSERT(!m_scrollCorner);
 
-    ASSERT(m_frame);
-    ASSERT(m_frame->view() != this || !m_frame->contentRenderer());
     // FIXME: Do we need to do something here for OOPI?
     HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
     if (ownerElement && ownerElement->ownedWidget() == this)
         ownerElement->setWidget(nullptr);
+
+    disposeAutoSizeInfo();
+#if ENABLE(OILPAN) && ENABLE(ASSERT)
+    m_hasBeenDisposed = true;
+#endif
+}
+
+void FrameView::trace(Visitor* visitor)
+{
+#if ENABLE(OILPAN)
+    visitor->trace(m_widgetUpdateSet);
+    visitor->trace(m_widgets);
+    visitor->trace(m_frame);
+    visitor->trace(m_nodeToDraw);
+    visitor->trace(m_maintainScrollPositionAnchor);
+    visitor->trace(m_scrollCorner);
+    visitor->trace(m_autoSizeInfo);
+#endif
+    ScrollView::trace(visitor);
 }
 
 void FrameView::reset()
 {
     m_hasPendingLayout = false;
     m_layoutSubtreeRoot = 0;
     m_doFullPaintInvalidation = false;
     m_layoutSchedulingEnabled = true;
     m_inPerformLayout = false;
     m_canInvalidatePaintDuringPerformLayout = false;
@@ skipping 55 matching lines @@
 
     detachCustomScrollbars();
     // When the view is no longer associated with a frame, it needs to be removed from the ax object cache
     // right now, otherwise it won't be able to reach the topDocument()'s axObject cache later.
     removeFromAXObjectCache();
 
     if (m_frame->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = m_frame->page()->scrollingCoordinator())
             scrollingCoordinator->willDestroyScrollableArea(this);
     }
+
+#if ENABLE(OILPAN)
+    // FIXME: once/if dust settles, do this always (non-Oilpan)?
+    //
+    // FIXME: Oilpan: is this safe to dispose() if there are FrameView protections on the stack?

[sof, 2014/10/08 11:52:25]

This is one of the main issues left to resolve.

[sof, 2014/10/08 14:43:41]

cf.
https://codereview.chromium.org/603193005/diff/40001/Source/core/frame/LocalF...

[haraken, 2014/10/08 15:15:43]

Are there many protecting pointers? If there are only a handful of protecting
pointers, can we probably take a quick look at if it's OK to dispose the
FrameView while protecting the FrameView?

I haven't studied the code, but what this CL is doing basically makes sense to
me --- a FrameView is disposed (but still alive) when the FrameView is
explicitly detached, and the FrameView is collected after the last reference to
the FrameView is lost.

+    dispose();
+#endif
 }
 
 void FrameView::detachCustomScrollbars()
 {
     Scrollbar* horizontalBar = horizontalScrollbar();
     if (horizontalBar && horizontalBar->isCustomScrollbar())
         setHasHorizontalScrollbar(false);
 
     Scrollbar* verticalBar = verticalScrollbar();
     if (verticalBar && verticalBar->isCustomScrollbar())
@@ skipping 135 matching lines @@
     // If we have an owning ipage/LocalFrame element, then it can set the custom scrollbar also.
     RenderPart* frameRenderer = m_frame->ownerRenderer();
     if (frameRenderer && frameRenderer->style()->hasPseudoStyle(SCROLLBAR)) {
         customScrollbarFrame = m_frame.get();
         return true;
     }
 
     return false;
 }
 
-PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
+PassRefPtrWillBeRawPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
 {
     Element* customScrollbarElement = 0;
     LocalFrame* customScrollbarFrame = 0;
     if (shouldUseCustomScrollbars(customScrollbarElement, customScrollbarFrame))
         return RenderScrollbar::createCustomScrollbar(this, orientation, customScrollbarElement, customScrollbarFrame);
 
     // Nobody set a custom style, so we just use a native scrollbar.
     return ScrollView::createScrollbar(orientation);
 }
 
@@ skipping 250 matching lines @@
     if (svgRoot->everHadLayout() && !svgRoot->needsLayout())
         return;
 
     // If the embedded SVG document appears the first time, the ownerRenderer has already finished
     // layout without knowing about the existence of the embedded SVG document, because RenderReplaced
     // embeddedContentBox() returns 0, as long as the embedded document isn't loaded yet. Before
     // bothering to lay out the SVG document, mark the ownerRenderer needing layout and ask its
     // FrameView for a layout. After that the RenderEmbeddedObject (ownerRenderer) carries the
     // correct size, which RenderSVGRoot::computeReplacedLogicalWidth/Height rely on, when laying
     // out for the first time, or when the RenderSVGRoot size has changed dynamically (eg. via <script>).
-    RefPtr<FrameView> frameView = ownerRenderer->frame()->view();
+    RefPtrWillBeRawPtr<FrameView> frameView = ownerRenderer->frame()->view();
 
     // Mark the owner renderer as needing layout.
     ownerRenderer->setNeedsLayoutAndPrefWidthsRecalcAndFullPaintInvalidation();
 
     // Synchronously enter layout, to layout the view containing the host object/embed/iframe.
     ASSERT(frameView);
     frameView->layout();
 }
 
 void FrameView::performPreLayoutTasks()
@@ skipping 91 matching lines @@
 
     ScriptForbiddenScope forbidScript;
 
     if (isInPerformLayout() || !m_frame->document()->isActive())
         return;
 
     TRACE_EVENT0("blink", "FrameView::layout");
     TRACE_EVENT_SCOPED_SAMPLING_STATE("blink", "Layout");
 
     // Protect the view from being deleted during layout (in recalcStyle)
-    RefPtr<FrameView> protector(this);
+    RefPtrWillBeRawPtr<FrameView> protector(this);
 
     // Every scroll that happens during layout is programmatic.
     TemporaryChange<bool> changeInProgrammaticScroll(m_inProgrammaticScroll, true);
 
     if (m_autoSizeInfo)
         m_autoSizeInfo->autoSizeIfNeeded();
 
     m_hasPendingLayout = false;
     DocumentLifecycle::Scope lifecycleScope(lifecycle(), DocumentLifecycle::LayoutClean);
 
     RELEASE_ASSERT(!isPainting());
 
     TRACE_EVENT_BEGIN1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "Layout", "beginData", InspectorLayoutEvent::beginData(this));
     TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline.stack"), "CallStack", "stack", InspectorCallStackEvent::currentCallStack());
     // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.
     InspectorInstrumentationCookie cookie = InspectorInstrumentation::willLayout(m_frame.get());
 
     if (!allowSubtree && isSubtreeLayout()) {
         m_layoutSubtreeRoot->markContainingBlocksForLayout(false);
         m_layoutSubtreeRoot = 0;
     }
 
     performPreLayoutTasks();
 
+#if !ENABLE(OILPAN)
     // If there is only one ref to this view left, then its going to be destroyed as soon as we exit,
     // so there's no point to continuing to layout
     if (protector->hasOneRef())
         return;
+#endif
 
     Document* document = m_frame->document();
     bool inSubtreeLayout = isSubtreeLayout();
     RenderObject* rootForThisLayout = inSubtreeLayout ? m_layoutSubtreeRoot : document->renderView();
     if (!rootForThisLayout) {
         // FIXME: Do we need to set m_size here?
         ASSERT_NOT_REACHED();
         return;
     }
 
@@ skipping 661 matching lines @@
         ResourceLoadPriorityOptimizer::resourceLoadPriorityOptimizer()->updateAllImageResourcePriorities();
     }
 }
 
 void FrameView::updateLayersAndCompositingAfterScrollIfNeeded()
 {
     // Nothing to do after scrolling if there are no fixed position elements.
     if (!hasViewportConstrainedObjects())
         return;
 
-    RefPtr<FrameView> protect(this);
+    RefPtrWillBeRawPtr<FrameView> protect(this);
 
     // If there fixed position elements, scrolling may cause compositing layers to change.
     // Update widget and layer positions after scrolling, but only if we're not inside of
     // layout.
     if (!m_nestedLayoutCount) {
         updateWidgetPositions();
         if (RenderView* renderView = this->renderView())
             renderView->layer()->setNeedsCompositingInputsUpdate();
     }
 }
@@ skipping 361 matching lines @@
         // FIXME: Do we really need to prevent this?
         m_widgetUpdateSet.remove(&object);
     }
 
     return m_widgetUpdateSet.isEmpty();
 }
 
 void FrameView::updateWidgetsTimerFired(Timer<FrameView>*)
 {
     ASSERT(!isInPerformLayout());
-    RefPtr<FrameView> protect(this);
+    RefPtrWillBeRawPtr<FrameView> protect(this);
     m_updateWidgetsTimer.stop();
     for (unsigned i = 0; i < maxUpdateWidgetsIterations; ++i) {
         if (updateWidgets())
             return;
     }
 }
 
 void FrameView::flushAnyPendingPostLayoutTasks()
 {
     ASSERT(!isInPerformLayout());
@@ skipping 12 matching lines @@
 }
 
 void FrameView::performPostLayoutTasks()
 {
     // FIXME: We can reach here, even when the page is not active!
     // http/tests/inspector/elements/html-link-import.html and many other
     // tests hit that case.
     // We should ASSERT(isActive()); or at least return early if we can!
     ASSERT(!isInPerformLayout()); // Always before or after performLayout(), part of the highest-level layout() call.
     TRACE_EVENT0("blink", "FrameView::performPostLayoutTasks");
-    RefPtr<FrameView> protect(this);
+    RefPtrWillBeRawPtr<FrameView> protect(this);
 
     m_postLayoutTasksTimer.stop();
 
     m_frame->selection().setCaretRectNeedsUpdate();
 
     {
         // Hits in compositing/overflow/do-not-repaint-if-scrolling-composited-layers.html
         DisableCompositingQueryAsserts disabler;
         m_frame->selection().updateAppearance();
     }
@@ skipping 426 matching lines @@
     if (htmlElement && htmlElement->renderer())
         result = result.blend(htmlElement->renderer()->style()->visitedDependentColor(CSSPropertyBackgroundColor));
     if (bodyElement && bodyElement->renderer())
         result = result.blend(bodyElement->renderer()->style()->visitedDependentColor(CSSPropertyBackgroundColor));
 
     return result;
 }
 
 bool FrameView::hasCustomScrollbars() const
 {
-    const HashSet<RefPtr<Widget> >* viewChildren = children();
-    HashSet<RefPtr<Widget> >::const_iterator end = viewChildren->end();
-    for (HashSet<RefPtr<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
+    const WillBeHeapHashSet<RefPtrWillBeMember<Widget> >* viewChildren = children();
+    WillBeHeapHashSet<RefPtrWillBeMember<Widget> >::const_iterator end = viewChildren->end();
+    for (WillBeHeapHashSet<RefPtrWillBeMember<Widget> >::const_iterator current = viewChildren->begin(); current != end; ++current) {
         Widget* widget = current->get();
         if (widget->isFrameView()) {
             if (toFrameView(widget)->hasCustomScrollbars())
                 return true;
         } else if (widget->isScrollbar()) {
             Scrollbar* scrollbar = static_cast<Scrollbar*>(widget);
             if (scrollbar->isCustomScrollbar())
                 return true;
         }
     }
@@ skipping 158 matching lines @@
         return;
 
     m_needsUpdateWidgetPositions = false;
 
     updateWidgetPositions();
 }
 
 void FrameView::updateLayoutAndStyleForPainting()
 {
     // Updating layout can run script, which can tear down the FrameView.
-    RefPtr<FrameView> protector(this);
+    RefPtrWillBeRawPtr<FrameView> protector(this);
 
     updateLayoutAndStyleIfNeededRecursive();
 
     updateWidgetPositionsIfNeeded();
 
     RenderView* view = renderView();
     if (view) {
         TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "UpdateLayerTree", "frame", m_frame.get());
         // FIXME(361045): remove InspectorInstrumentation calls once DevTools Timeline migrates to tracing.
         InspectorInstrumentation::willUpdateLayerTree(m_frame.get());
@@ skipping 27 matching lines @@
     // region but then become included later by the second frame adding rects to the dirty region
     // when it lays out.
 
     m_frame->document()->updateRenderTreeIfNeeded();
 
     if (needsLayout())
         layout();
 
     // FIXME: Calling layout() shouldn't trigger scripe execution or have any
     // observable effects on the frame tree but we're not quite there yet.
-    Vector<RefPtr<FrameView> > frameViews;
+    WillBeHeapVector<RefPtrWillBeMember<FrameView> > frameViews;
     for (Frame* child = m_frame->tree().firstChild(); child; child = child->tree().nextSibling()) {
         if (!child->isLocalFrame())
             continue;
         if (FrameView* view = toLocalFrame(child)->view())
             frameViews.append(view);
     }
 
-    const Vector<RefPtr<FrameView> >::iterator end = frameViews.end();
-    for (Vector<RefPtr<FrameView> >::iterator it = frameViews.begin(); it != end; ++it)
+    const WillBeHeapVector<RefPtrWillBeMember<FrameView> >::iterator end = frameViews.end();
+    for (WillBeHeapVector<RefPtrWillBeMember<FrameView> >::iterator it = frameViews.begin(); it != end; ++it)
         (*it)->updateLayoutAndStyleIfNeededRecursive();
 
     // When an <iframe> gets composited, it triggers an extra style recalc in its containing FrameView.
     // To avoid pushing an invalid tree for display, we have to check for this case and do another
     // style recalc. The extra style recalc needs to happen after our child <iframes> were updated.
     // FIXME: We shouldn't be triggering an extra style recalc in the first place.
     if (m_frame->document()->hasSVGFilterElementsRequiringLayerUpdate()) {
         m_frame->document()->updateRenderTreeIfNeeded();
 
         if (needsLayout())
@@ skipping 20 matching lines @@
         if (!child->isLocalFrame())
             continue;
 
         toLocalFrame(child)->view()->invalidateTreeIfNeededRecursive();
     }
 }
 
 void FrameView::enableAutoSizeMode(const IntSize& minSize, const IntSize& maxSize)
 {
     if (!m_autoSizeInfo)
-        m_autoSizeInfo = adoptPtr(new FrameViewAutoSizeInfo(this));
+        m_autoSizeInfo = FrameViewAutoSizeInfo::create(this);
 
     m_autoSizeInfo->configureAutoSizeMode(minSize, maxSize);
+    setLayoutSizeFixedToFrameSize(true);
+    setNeedsLayout();
+    scheduleRelayout();
+}
+
+void FrameView::disposeAutoSizeInfo()
+{
+    if (!m_autoSizeInfo)
+        return;
+
+    setLayoutSizeFixedToFrameSize(false);
+    setNeedsLayout();
+    scheduleRelayout();
+
+    // Since autosize mode forces the scrollbar mode, change them to being auto.
+    setVerticalScrollbarLock(false);
+    setHorizontalScrollbarLock(false);
+    setScrollbarModes(ScrollbarAuto, ScrollbarAuto);
+    m_autoSizeInfo.clear();
 }
 
 void FrameView::forceLayout(bool allowSubtree)
 {
     layout(allowSubtree);
 }
 
 void FrameView::forceLayoutForPagination(const FloatSize& pageSize, const FloatSize& originalPageSize, float maximumShrinkFactor)
 {
     // Dumping externalRepresentation(m_frame->renderer()).ascii() is a good trick to see
@@ skipping 379 matching lines @@
     IntSize visibleSize = expandedIntSize(visibleContentSizeF);
 
     IntPoint maximumOffset(
         contentsWidth() - visibleSize.width() - scrollOrigin().x(),
         contentsHeight() - visibleSize.height() - scrollOrigin().y());
     maximumOffset.clampNegativeToZero();
     return maximumOffset;
 }
 
 } // namespace blink