Move the Widget hierarchy to the Oilpan heap.

Source/web/WebPluginContainerImpl.cpp

Index: Source/web/WebPluginContainerImpl.cpp
diff --git a/Source/web/WebPluginContainerImpl.cpp b/Source/web/WebPluginContainerImpl.cpp
index 4adc15c159fa4b21adddec32ae9ebe0091593cd1..bb25404c60e1cb7f932a80bb3125036708972a05 100644
--- a/Source/web/WebPluginContainerImpl.cpp
+++ b/Source/web/WebPluginContainerImpl.cpp
@@ -175,7 +175,7 @@ void WebPluginContainerImpl::handleEvent(Event* event)
     if (!m_webPlugin->acceptsInputEvents())
         return;
 
-    RefPtr<WebPluginContainerImpl> protector(this);
+    RefPtrWillBeRawPtr<WebPluginContainerImpl> protect(this);
     // The events we pass are defined at:
     //    http://devedge-temp.mozilla.org/library/manuals/2002/plugin/1.0/structures5.html#1000000
     // Don't take the documentation as truth, however.  There are many cases
@@ -674,14 +674,10 @@ bool WebPluginContainerImpl::paintCustomOverhangArea(GraphicsContext* context, c
 // Private methods -------------------------------------------------------------
 
 WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPlugin* webPlugin)
-#if ENABLE(OILPAN)
-    : m_frame(element->document().frame())
-#else
     : FrameDestructionObserver(element->document().frame())
-#endif
     , m_element(element)
     , m_webPlugin(webPlugin)
-    , m_webLayer(0)
+    , m_webLayer(nullptr)
     , m_touchEventRequestType(TouchEventRequestTypeNone)
     , m_wantsWheelEvents(false)
 {
@@ -690,28 +686,30 @@ WebPluginContainerImpl::WebPluginContainerImpl(HTMLPlugInElement* element, WebPl
 WebPluginContainerImpl::~WebPluginContainerImpl()
 {
 #if ENABLE(OILPAN)
-    // The element (and its document) are heap allocated and may
-    // have been finalized by now; unsafe to unregister the touch
-    // event handler at this stage.
-    //
-    // This is acceptable, as the widget will unregister itself if it
-    // is cleanly detached. If an explicit detach doesn't happen, this
-    // container is assumed to have died with the plugin element (and
-    // its document), hence no unregistration step is needed.
-    //
-    m_element = 0;
+    // The plugin container must have been disposed of already.
+    ASSERT(!m_webPlugin);
 #else
     if (m_touchEventRequestType != TouchEventRequestTypeNone && m_element->document().frameHost())
         m_element->document().frameHost()->eventHandlerRegistry().didRemoveEventHandler(*m_element, EventHandlerRegistry::TouchEvent);
+
+    dispose();
 #endif
+}
 
+void WebPluginContainerImpl::dispose()

[haraken, 2014/09/29 14:16:37]

Shall we clear m_element in dispose() ?

[sof, 2014/10/02 14:03:54]

Done.

+{
     ScriptForbiddenScope::AllowSuperUnsafeScript thisShouldBeRemoved;
 
     for (size_t i = 0; i < m_pluginLoadObservers.size(); ++i)
         m_pluginLoadObservers[i]->clearPluginContainer();
     m_webPlugin->destroy();
+    m_webPlugin = nullptr;
+
     if (m_webLayer)
         GraphicsLayer::unregisterContentsLayer(m_webLayer);
+
+    m_pluginLoadObservers.clear();
+    m_scrollbarGroup.clear();
 }
 
 #if ENABLE(OILPAN)
@@ -724,6 +722,12 @@ void WebPluginContainerImpl::detach()
 }
 #endif
 
+void WebPluginContainerImpl::trace(Visitor* visitor)
+{
+    FrameDestructionObserver::trace(visitor);
+    PluginView::trace(visitor);
+}
+
 void WebPluginContainerImpl::handleMouseEvent(MouseEvent* event)
 {
     ASSERT(parent()->isFrameView());