Move the Widget hierarchy to the Oilpan heap.

Source/web/WebPluginContainerImpl.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2014 Opera Software ASA. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 157 matching lines @@
     m_webPlugin->updateVisibility(false);
 
     Widget::hide();
 }
 
 void WebPluginContainerImpl::handleEvent(Event* event)
 {
     if (!m_webPlugin->acceptsInputEvents())
         return;
 
-    RefPtr<WebPluginContainerImpl> protector(this);
+    RefPtrWillBeRawPtr<WebPluginContainerImpl> protector(this);
     // The events we pass are defined at:
     //    http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
     // Don't take the documentation as truth, however.  There are many cases
     // where mozilla behaves differently than the spec.
     if (event->isMouseEvent())
         handleMouseEvent(toMouseEvent(event));
     else if (event->isWheelEvent())
         handleWheelEvent(toWheelEvent(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(toKeyboardEvent(event));
@@ skipping 243 matching lines @@
     if (!frame)
         return v8::Local<v8::Object>();
 
     if (!frame->script().canExecuteScripts(NotAboutToExecuteScript))
         return v8::Local<v8::Object>();
 
     ScriptState* scriptState = ScriptState::forMainWorld(frame);
     if (!scriptState->contextIsValid())
         return v8::Local<v8::Object>();
 
-    v8::Handle<v8::Value> v8value = toV8(m_element, scriptState->context()->Global(), scriptState->isolate());
+    v8::Handle<v8::Value> v8value = toV8(m_element.get(), scriptState->context()->Global(), scriptState->isolate());
     ASSERT(v8value->IsObject());
 
     return v8::Handle<v8::Object>::Cast(v8value);
 }
 
 WebString WebPluginContainerImpl::executeScriptURL(const WebURL& url, bool popupsAllowed)
 {
     LocalFrame* frame = m_element->document().frame();
     if (!frame)
         return WebString();
@@ skipping 214 matching lines @@
     context->setFillColor(Color(0xCC, 0xCC, 0xCC));
     context->fillRect(intersection(horizontalOverhangArea, dirtyRect));
     context->fillRect(intersection(verticalOverhangArea, dirtyRect));
     context->restore();
     return true;
 }
 
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPlugin* webPlugin)
-#if ENABLE(OILPAN)
-    : m_frame(element->document().frame())
-#else
     : FrameDestructionObserver(element->document().frame())
-#endif
     , m_element(element)
     , m_webPlugin(webPlugin)
-    , m_webLayer(0)
+    , m_webLayer(nullptr)
     , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
+#if ENABLE(OILPAN)
+    , m_isAllowedToDisposePlugin(false)
+#endif
 {
 }
 
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
 #if ENABLE(OILPAN)
-    // The element (and its document) are heap allocated and may
-    // have been finalized by now; unsafe to unregister the touch
-    // event handler at this stage.
-    //
-    // This is acceptable, as the widget will unregister itself if it
-    // is cleanly detached. If an explicit detach doesn't happen, this
-    // container is assumed to have died with the plugin element (and
-    // its document), hence no unregistration step is needed.
-    //
-    m_element = 0;
+    // The plugin container must have been disposed of already.
+    if (m_isAllowedToDisposePlugin)
+        dispose();
+    ASSERT(!m_webPlugin);
 #else
-    if (m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
+    dispose();
+#endif
+}
+
+void WebPluginContainerImpl::dispose()
+{
+    if (m_element && m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
         m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
-#endif
 
     ScriptForbiddenScope::AllowSuperUnsafeScript thisShouldBeRemoved;
 
     for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
         m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
+    m_webPlugin = nullptr;
+
     if (m_webLayer)
         GraphicsLayer::unregisterContentsLayer(m_webLayer);
+
+    m_pluginLoadObservers.clear();
+    m_scrollbarGroup.clear();
+    m_element = nullptr;
 }
 
 #if ENABLE(OILPAN)
-void WebPluginContainerImpl::detach()
+void WebPluginContainerImpl::setIsAllowedToDisposePlugin()
 {
-    if (m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
-        m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
-
-    setWebLayer(0);
+    // If the LocalFrame is still alive, but the plugin element isn't, the
+    // LocalFrame will set m_isAllowedToDisposePlugin via
+    // its weak pointer callback. This is a signal that the plugin container
+    // must dispose of its plugin when finalizing. The LocalFrame and
+    // all objects accessible from it can safely be accessed, but not
+    // the plugin element itself.

[haraken, 2014/10/10 02:50:32]

Help me understand:

1) Why can't you simply call WebPluginContainerImpl::dispose() in the weak
callback of LocalFrame::m_pluginElements ?

2) If the WebPluginContainerImpl and the LocalFrame die together,
WebPluginContainerImpl::dispose() won't be called. Is this OK?

3) What happens if we register a pre-finalizer of WebPluginContainerImpl and
call WebPluginContainerImpl::dispose() in the pre-finalizer?

[sof, 2014/10/10 05:22:19]

Unbounded amounts of work and allocation might result, so this wouldn't be
suitable.
If the LocalFrame hasn't been detached before that time, the plugins won't be.
That's as good as it gets, I think.
Answered elsewhere; not suitable.

+    ASSERT(!m_isAllowedToDisposePlugin);
+    m_isAllowedToDisposePlugin = true;
+    m_element = nullptr;
 }
 #endif
 
+void WebPluginContainerImpl::trace(Visitor* visitor)
+{
+    visitor->trace(m_element);
+    FrameDestructionObserver::trace(visitor);
+    PluginView::trace(visitor);
+}
+
 void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
 {
     ASSERT(parent()->isFrameView());
 
     if (event->isDragEvent()) {
         if (m_webPlugin->canProcessDrag())
             handleDragEvent(event);
         return;
     }
 
@@ skipping 225 matching lines @@
 
     return clipRect;
 }
 
 bool WebPluginContainerImpl::pluginShouldPersist() const
 {
     return m_webPlugin->shouldPersist();
 }
 
 } // namespace blink