Move the Widget hierarchy to the Oilpan heap.

Source/core/frame/LocalFrame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 75 matching lines @@
     Frame* parent = frame->tree().parent();
     if (!parent || !parent->isLocalFrame())
         return 1;
     return toLocalFrame(parent)->textZoomFactor();
 }
 
 inline LocalFrame::LocalFrame(FrameLoaderClient* client, FrameHost* host, FrameOwner* owner)
     : Frame(client, host, owner)
     , m_loader(this)
     , m_navigationScheduler(this)
-    , m_script(adoptPtr(new ScriptController(this)))
+    , m_script(ScriptController::create(this))
     , m_editor(Editor::create(*this))
     , m_spellChecker(SpellChecker::create(*this))
     , m_selection(FrameSelection::create(this))
     , m_eventHandler(adoptPtrWillBeNoop(new EventHandler(this)))
     , m_console(FrameConsole::create(*this))
     , m_inputMethodController(InputMethodController::create(*this))
     , m_pageZoomFactor(parentPageZoomFactor(this))
     , m_textZoomFactor(parentTextZoomFactor(this))
     , m_inViewSourceMode(false)
 {
@@ skipping 31 matching lines @@
         (*it)->frameDestroyed();
 #endif
 }
 
 void LocalFrame::trace(Visitor* visitor)
 {
 #if ENABLE(OILPAN)
     visitor->trace(m_destructionObservers);
     visitor->trace(m_loader);
     visitor->trace(m_navigationScheduler);
+    visitor->trace(m_view);
     visitor->trace(m_pagePopupOwner);
     visitor->trace(m_editor);
     visitor->trace(m_spellChecker);
     visitor->trace(m_selection);
     visitor->trace(m_eventHandler);
     visitor->trace(m_console);
     visitor->trace(m_inputMethodController);
     HeapSupplementable<LocalFrame>::trace(visitor);
 #endif
     Frame::trace(visitor);
@@ skipping 31 matching lines @@
 {
     // We detach the FrameView's custom scroll bars as early as
     // possible to prevent m_doc->detach() from messing with the view
     // such that its scroll bars won't be torn down.
     //
     // FIXME: We should revisit this.
     if (m_view)
         m_view->prepareForDetach();
 }
 
-void LocalFrame::setView(PassRefPtr<FrameView> view)
+void LocalFrame::setView(PassRefPtrWillBeRawPtr<FrameView> view)
 {
     detachView();
 
     // Prepare for destruction now, so any unload event handlers get run and the LocalDOMWindow is
     // notified. If we wait until the view is destroyed, then things won't be hooked up enough for
     // these calls to work.
     if (!view && document() && document()->isActive()) {
         // FIXME: We don't call willRemove here. Why is that OK?
         document()->prepareForDestruction();
     }
 
     eventHandler().clear();
 
+    if (m_view && !view)
+        m_view->dispose();

[haraken, 2014/09/26 09:19:25]

Just help me understand: Why is it OK to promptly dispose the FrameView here?
Isn't it possible there are other holders of the FrameView?

[sof, 2014/09/28 08:05:53]

A key question. I think it would be safer if the disposal happened at the
outermost "protect" holder, should there be any. This would only be observable
with Oilpan enabled, but the FrameViews of detached frames could be observable
by others as being in a disposed state.

The only way (I know of) to delay the disposal is to have a custom
protector-like RAII object, like what was proposed for as-eager-as-could-be
frame finalization. But perhaps there are other ways to go about it; thoughts?

[sof, 2014/09/28 08:20:32]

Forgot to say -- no tests exercise code paths that rely on there not being a
disposed FrameView upon the return of a call that detached a frame. I don't know
if any of the Frame/FrameView protected uses depend on that not happening; but
it seems like a subtle, extra assumption to add.

+
     m_view = view;
 
     if (m_view && isMainFrame()) {
         if (settings()->pinchVirtualViewportEnabled())
             m_host->pinchViewport().mainFrameDidChangeSize();
         else
             m_view->setVisibleContentScaleFactor(page()->pageScaleFactor());
     }
 }
 
@@ skipping 207 matching lines @@
     ASSERT(this);
     ASSERT(page());
 
     bool isLocalRoot = this->isLocalRoot();
 
     if (isLocalRoot && view())
         view()->setParentVisible(false);
 
     setView(nullptr);
 
-    RefPtr<FrameView> frameView;
+    RefPtrWillBeRawPtr<FrameView> frameView = nullptr;
     if (isLocalRoot) {
         frameView = FrameView::create(this, viewportSize);
 
         // The layout size is set by WebViewImpl to support @viewport
         frameView->setLayoutSizeFixedToFrameSize(false);
     } else
         frameView = FrameView::create(this);
 
     frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode, horizontalLock, verticalLock);
 
@@ skipping 279 matching lines @@
 
     return curFrame;
 }
 
 void LocalFrame::setPagePopupOwner(Element& owner)
 {
     m_pagePopupOwner = &owner;
 }
 
 } // namespace blink