Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.cpp

 /**
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Stefan Schimanski (1Stein@gmx.de)
  * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 69 matching lines @@
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
         m_NPObject = 0;
     }
 }
 
 void HTMLPlugInElement::trace(Visitor* visitor)
 {
     visitor->trace(m_imageLoader);
     visitor->trace(m_placeholder);
+    visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void HTMLPlugInElement::disconnectContentFrame()
+{
+    if (m_persistedPluginWidget) {
+        m_persistedPluginWidget->dispose();
+        m_persistedPluginWidget = nullptr;
+    }
+    HTMLFrameOwnerElement::disconnectContentFrame();
+}
+
+void HTMLPlugInElement::shouldDisposePlugin()
+{
+    if (m_persistedPluginWidget && m_persistedPluginWidget->isPluginView())
+        toPluginView(m_persistedPluginWidget.get())->shouldDisposePlugin();
+}
+#endif
+
+void HTMLPlugInElement::setPersistedPluginWidget(Widget* widget)
+{
+#if ENABLE(OILPAN)
+    if (m_persistedPluginWidget && m_persistedPluginWidget != widget) {
+        if (m_persistedPluginWidget->isPluginView()) {
+            if (LocalFrame* frame = toPluginView(m_persistedPluginWidget.get())->pluginFrame()) {

[haraken, 2014/10/11 17:33:02]

Can we add ASSERT(frame) instead of having an if branch?

[sof, 2014/10/12 08:16:22]

Done.

+                frame->unregisterPluginElement(this);
+            }
+        }
+    }
+    if (widget && widget->isPluginView()) {
+        if (LocalFrame* frame = toPluginView(widget)->pluginFrame()) {

[haraken, 2014/10/11 17:33:02]

Ditto.

[sof, 2014/10/12 08:16:22]

Done.

+            frame->registerPluginElement(this);
+        }
+    }
+#endif
+    m_persistedPluginWidget = widget;
+}
+
 bool HTMLPlugInElement::canProcessDrag() const
 {
     return pluginWidget() && pluginWidget()->isPluginView() && toPluginView(pluginWidget())->canProcessDrag();
 }
 
 bool HTMLPlugInElement::willRespondToMouseClickEvents()
 {
     if (isDisabledFormControl())
         return false;
     RenderObject* r = renderer();
@@ skipping 92 matching lines @@
     if (renderer() && !useFallbackContent())
         setNeedsWidgetUpdate(true);
     if (m_isDelayingLoadEvent) {
         m_isDelayingLoadEvent = false;
         document().decrementLoadEventDelayCount();
     }
 
     // Only try to persist a plugin widget we actually own.
     Widget* plugin = ownedWidget();
     if (plugin && plugin->pluginShouldPersist())
-        m_persistedPluginWidget = plugin;
-#if ENABLE(OILPAN)
-    else if (plugin)
-        plugin->detach();
-#endif
+        setPersistedPluginWidget(plugin);
+
     resetInstance();
-    // FIXME - is this next line necessary?
+    // Clear the widget; will trigger disposal of it with Oilpan.
     setWidget(nullptr);
 
     if (m_isCapturingMouseEvents) {
         if (LocalFrame* frame = document().frame())
             frame->eventHandler().setCapturingMouseEventsNode(nullptr);
         m_isCapturingMouseEvents = false;
     }
 
     if (m_NPObject) {
         _NPN_ReleaseObject(m_NPObject);
@@ skipping 107 matching lines @@
     // FIXME: Mouse down and scroll events are passed down to plug-in via custom
     // code in EventHandler; these code paths should be united.
 
     RenderObject* r = renderer();
     if (!r || !r->isRenderPart())
         return;
     if (r->isEmbeddedObject()) {
         if (toRenderEmbeddedObject(r)->showsUnavailablePluginIndicator())
             return;
     }
-    RefPtr<Widget> widget = toRenderPart(r)->widget();
+    RefPtrWillBeRawPtr<Widget> widget = toRenderPart(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
     if (event->defaultHandled())
         return;
     HTMLFrameOwnerElement::defaultEventHandler(event);
 }
 
 RenderPart* HTMLPlugInElement::renderPartForJSBindings() const
 {
@@ skipping 122 matching lines @@
 
     RenderEmbeddedObject* renderer = renderEmbeddedObject();
     // FIXME: This code should not depend on renderer!
     if ((!renderer && requireRenderer) || useFallback)
         return false;
 
     WTF_LOG(Plugins, "%p Plug-in URL: %s", this, m_url.utf8().data());
     WTF_LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
-    OwnPtrWillBeRawPtr<PluginPlaceholder> placeholder;
-    RefPtr<Widget> widget = m_persistedPluginWidget;
+    OwnPtrWillBeRawPtr<PluginPlaceholder> placeholder = nullptr;
+    RefPtrWillBeRawPtr<Widget> widget = m_persistedPluginWidget;
     if (!widget) {
         bool loadManually = document().isPluginDocument() && !document().containsPlugins();
         placeholder = frame->loader().client()->createPluginPlaceholder(document(), url, paramNames, paramValues, mimeType, loadManually);
         if (!placeholder) {
             FrameLoaderClient::DetachedPluginPolicy policy = requireRenderer ? FrameLoaderClient::FailOnDetachedPlugin : FrameLoaderClient::AllowDetachedPlugin;
             widget = frame->loader().client()->createPlugin(this, url, paramNames, paramValues, mimeType, loadManually, policy);
         }
     }
 
     if (!placeholder && !widget) {
         if (renderer && !renderer->showsUnavailablePluginIndicator())
             renderer->setPluginUnavailabilityReason(RenderEmbeddedObject::PluginMissing);
         setPlaceholder(nullptr);
         return false;
     }
 
     if (placeholder) {
         setPlaceholder(placeholder.release());
         return true;
     }
 
     if (renderer) {
         setWidget(widget);
-        m_persistedPluginWidget = nullptr;
+        setPersistedPluginWidget(nullptr);
     } else if (widget != m_persistedPluginWidget) {

[haraken, 2014/10/11 17:33:02]

The 'widget != m_persistedPluginWidget' check won't be needed since it's checked
in setPersistedPluginWidget.

[sof, 2014/10/12 08:16:22]

Not quite, but I've now made setPersistendPluginWidget() do so.

-        m_persistedPluginWidget = widget;
+        setPersistedPluginWidget(widget.get());
     }
     setPlaceholder(nullptr);
     document().setContainsPlugins();
     scheduleSVGFilterLayerUpdateHack();
     // Make sure any input event handlers introduced by the plugin are taken into account.
     if (Page* page = document().frame()->page()) {
         if (ScrollingCoordinator* scrollingCoordinator = page->scrollingCoordinator())
             scrollingCoordinator->notifyLayoutUpdated();
     }
     return true;
@@ skipping 92 matching lines @@
     return hasAuthorShadowRoot();
 }
 
 void HTMLPlugInElement::lazyReattachIfNeeded()
 {
     if (!useFallbackContent() && !usePlaceholderContent() && needsWidgetUpdate() && renderer() && !isImageType())
         lazyReattachIfAttached();
 }
 
 }