Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 68 matching lines @@
 
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
         m_NPObject = 0;
     }
 }
 
 void HTMLPlugInElement::trace(Visitor* visitor)
 {
     visitor->trace(m_imageLoader);
+    visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void HTMLPlugInElement::disconnectContentFrame()
+{
+    if (m_persistedPluginWidget) {
+        m_persistedPluginWidget->dispose();
+        m_persistedPluginWidget = nullptr;
+    }
+    HTMLFrameOwnerElement::disconnectContentFrame();
+}
+#endif
+
+void HTMLPlugInElement::setPersistedPluginWidget(Widget* widget)

[sof, 2014/10/08 11:52:25]

This scheme is not complete and doesn't solve the problematic case of having a
non-tree plugin element with a renderer-less plugin, with the element then
becoming unreachable and eventually swept.

For that case, we need to inject an explicit dispose of the underlying plugin
before the plugin element (and frame) goes away. There's no support for that
here, nor do I see how to achieve it.

It does address the case where the LocalFrame and plugin element die at the same
time, but not before the LocalFrame is detached.

+{
+#if ENABLE(OILPAN)
+    if (widget->isPluginView()) {
+        PluginView* plugin = toPluginView(widget);
+        if (LocalFrame* frame = plugin->pluginFrame()) {
+            frame->registerPluginElement(this);
+        }
+    }
+#endif
+    m_persistedPluginWidget = widget;
+}
+
 bool HTMLPlugInElement::canProcessDrag() const
 {
     return pluginWidget() && pluginWidget()->isPluginView() && toPluginView(pluginWidget())->canProcessDrag();
 }
 
 bool HTMLPlugInElement::willRespondToMouseClickEvents()
 {
     if (isDisabledFormControl())
         return false;
     RenderObject* r = renderer();
@@ skipping 92 matching lines @@
     if (renderer() && !useFallbackContent())
         setNeedsWidgetUpdate(true);
     if (m_isDelayingLoadEvent) {
         m_isDelayingLoadEvent = false;
         document().decrementLoadEventDelayCount();
     }
 
     // Only try to persist a plugin widget we actually own.
     Widget* plugin = ownedWidget();
     if (plugin && plugin->pluginShouldPersist())
-        m_persistedPluginWidget = plugin;
-#if ENABLE(OILPAN)
-    else if (plugin)
-        plugin->detach();
-#endif
+        setPersistedPluginWidget(plugin);
+
     resetInstance();
-    // FIXME - is this next line necessary?
+    // Clear the widget; will trigger disposal of it with Oilpan.
     setWidget(nullptr);
 
     if (m_isCapturingMouseEvents) {
         if (LocalFrame* frame = document().frame())
             frame->eventHandler().setCapturingMouseEventsNode(nullptr);
         m_isCapturingMouseEvents = false;
     }
 
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
@@ skipping 107 matching lines @@
     // FIXME: Mouse down and scroll events are passed down to plug-in via custom
     // code in EventHandler; these code paths should be united.
 
     RenderObject* r = renderer();
     if (!r || !r->isWidget())
         return;
     if (r->isEmbeddedObject()) {
         if (toRenderEmbeddedObject(r)->showsUnavailablePluginIndicator())
             return;
     }
-    RefPtr<Widget> widget = toRenderWidget(r)->widget();
+    RefPtrWillBeRawPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
     if (event->defaultHandled())
         return;
     HTMLFrameOwnerElement::defaultEventHandler(event);
 }
 
 RenderWidget* HTMLPlugInElement::renderWidgetForJSBindings() const
 {
@@ skipping 122 matching lines @@
 
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     // FIXME: This code should not depend on renderer!
     if ((!renderer && requireRenderer) || useFallback)
         return false;
 
     WTF_LOG(Plugins, "%p Plug-in URL: %s", this, m_url.utf8().data());
     WTF_LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
-    RefPtr<Widget> widget = m_persistedPluginWidget;
+    RefPtrWillBeRawPtr<Widget> widget = m_persistedPluginWidget;
     if (!widget) {
         bool loadManually = document().isPluginDocument() && !document().containsPlugins();
         FrameLoaderClient::DetachedPluginPolicy policy = requireRenderer ? FrameLoaderClient::FailOnDetachedPlugin : FrameLoaderClient::AllowDetachedPlugin;
         widget = frame->loader().client()->createPlugin(this, url, paramNames, paramValues, mimeType, loadManually, policy);
     }
 
     if (!widget) {
         if (renderer && !renderer->showsUnavailablePluginIndicator())
             renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginMissing);
         return false;
     }
 
     if (renderer) {
         setWidget(widget);
         m_persistedPluginWidget = nullptr;
     } else if (widget != m_persistedPluginWidget) {
-        m_persistedPluginWidget = widget;
+        setPersistedPluginWidget(widget.get());
     }
     document().setContainsPlugins();
     scheduleSVGFilterLayerUpdateHack();
     // Make sure any input event handlers introduced by the plugin are taken into account.
     if (Page* page = document().frame()->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
             scrollingCoordinator->notifyLayoutUpdated();
     }
     return true;
 }
@@ skipping 84 matching lines @@
     }
 }
 
 void HTMLPlugInElement::lazyReattachIfNeeded()
 {
     if (!useFallbackContent() && !usePlaceholderContent() && needsWidgetUpdate() && renderer() && !isImageType())
         lazyReattachIfAttached();
 }
 
 }