Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.h

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999-2001 Lars Knoll <knoll@kde.org>
  *                     1999-2001 Antti Koivisto <koivisto@kde.org>
  *                     2000-2001 Simon Hausmann <hausmann@kde.org>
  *                     2000-2001 Dirk Mueller <mueller@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ skipping 33 matching lines @@
     class DragImage;
     class Editor;
     class Element;
     class EventHandler;
     class FetchContext;
     class FloatSize;
     class FrameConsole;
     class FrameDestructionObserver;
     class FrameSelection;
     class FrameView;
+    class HTMLPlugInElement;
     class InputMethodController;
     class IntPoint;
     class IntSize;
     class Node;
     class Range;
     class RenderView;
     class TreeScope;
     class ScriptController;
     class SpellChecker;
     class TreeScope;
     class VisiblePosition;
 
     class LocalFrame : public Frame, public WillBeHeapSupplementable<LocalFrame>  {
     public:
         static PassRefPtrWillBeRawPtr<LocalFrame> create(FrameLoaderClient*, FrameHost*, FrameOwner*);
 
         virtual bool isLocalFrame() const override { return true; }
 
         void init();
-        void setView(PassRefPtr<FrameView>);
+        void setView(PassRefPtrWillBeRawPtr<FrameView>);
         void createView(const IntSize&, const Color&, bool,
             ScrollbarMode = ScrollbarAuto, bool horizontalLock = false,
             ScrollbarMode = ScrollbarAuto, bool verticalLock = false);
 
         virtual ~LocalFrame();
         virtual void trace(Visitor*) override;
 
         virtual void navigate(Document& originDocument, const KURL&, bool lockBackForwardList) override;
         virtual void detach() override;
 
@@ skipping 65 matching lines @@
         String selectedTextForClipboard() const;
 
         VisiblePosition visiblePositionForPoint(const IntPoint& framePoint);
         Document* documentAtPoint(const IntPoint& windowPoint);
         PassRefPtrWillBeRawPtr<Range> rangeForPoint(const IntPoint& framePoint);
 
         bool isURLAllowed(const KURL&) const;
         bool shouldReuseDefaultView(const KURL&) const;
         void removeSpellingMarkersUnderWords(const Vector<String>& words);
 
+#if ENABLE(OILPAN)
+        void registerPluginElement(HTMLPlugInElement*);
+        void unregisterPluginElement(HTMLPlugInElement*);
+        void clearWeakMembers(Visitor*);
+#endif
+
     // ========
 
     private:
         LocalFrame(FrameLoaderClient*, FrameHost*, FrameOwner*);
 
         String localLayerTreeAsText(unsigned flags) const;
 
         void detachView();
 
         WillBeHeapHashSet<RawPtrWillBeWeakMember<FrameDestructionObserver> > m_destructionObservers;
         mutable FrameLoader m_loader;
         mutable NavigationScheduler m_navigationScheduler;
 
-        RefPtr<FrameView> m_view;
+        RefPtrWillBeMember<FrameView> m_view;
         // Usually 0. Non-null if this is the top frame of PagePopup.
         RefPtrWillBeMember<Element> m_pagePopupOwner;
 
         const OwnPtrWillBeMember<ScriptController> m_script;
         const OwnPtrWillBeMember<Editor> m_editor;
         const OwnPtrWillBeMember<SpellChecker> m_spellChecker;
         const OwnPtrWillBeMember<FrameSelection> m_selection;
         const OwnPtrWillBeMember<EventHandler> m_eventHandler;
         const OwnPtrWillBeMember<FrameConsole> m_console;
-        OwnPtrWillBeMember<InputMethodController> m_inputMethodController;
+        const OwnPtrWillBeMember<InputMethodController> m_inputMethodController;
+
+#if ENABLE(OILPAN)
+        // Oilpan: in order to reliably finalize plugin elements with
+        // renderer-less plugins, the frame keeps track of them. When
+        // the frame is detached and disposed, these will be disposed
+        // of in the process. This is needed as the plugin element
+        // might not itself be attached to a DOM tree and be
+        // explicitly detached&disposed of.
+        //
+        // A weak reference is all wanted; the plugin element must
+        // otherwise be referenced and kept alive.
+        HeapHashSet<WeakMember<HTMLPlugInElement> > m_pluginElements;

[haraken, 2014/10/10 02:50:32]

This idea looks nice!

However, I want to understand one thing: Won't it be enough to register a
pre-finalizer to a Widget so that Widget::dispose() is called in the
pre-finalizer?

[sof, 2014/10/10 05:22:18]

dispose() of the plugin might trigger unbounded amounts of allocation, so
pre-finalizers aren't suitable.

+#endif
 
         float m_pageZoomFactor;
         float m_textZoomFactor;
 
         bool m_inViewSourceMode;
     };
 
     inline void LocalFrame::init()
     {
         m_loader.init();
@@ skipping 63 matching lines @@
     DEFINE_TYPE_CASTS(LocalFrame, Frame, localFrame, localFrame->isLocalFrame(), localFrame.isLocalFrame());
 
 } // namespace blink
 
 // During refactoring, there are some places where we need to do type conversions that
 // will not be needed once all instances of LocalFrame and RemoteFrame are sorted out.
 // At that time this #define will be removed and all the uses of it will need to be corrected.
 #define toLocalFrameTemporary toLocalFrame
 
 #endif // LocalFrame_h