Move the Widget hierarchy to the Oilpan heap.

Source/core/html/HTMLPlugInElement.cpp

Index: Source/core/html/HTMLPlugInElement.cpp
diff --git a/Source/core/html/HTMLPlugInElement.cpp b/Source/core/html/HTMLPlugInElement.cpp
index 4b9d597b145adc29ed8c8b965f3111df689daf81..a46e8df6ee31f70662743a330d261d6e1985bd51 100644
--- a/Source/core/html/HTMLPlugInElement.cpp
+++ b/Source/core/html/HTMLPlugInElement.cpp
@@ -86,9 +86,34 @@ HTMLPlugInElement::~HTMLPlugInElement()
 void HTMLPlugInElement::trace(Visitor* visitor)
 {
     visitor->trace(m_imageLoader);
+    visitor->trace(m_persistedPluginWidget);
     HTMLFrameOwnerElement::trace(visitor);
 }
 
+#if ENABLE(OILPAN)
+void HTMLPlugInElement::disconnectContentFrame()
+{
+    if (m_persistedPluginWidget) {
+        m_persistedPluginWidget->dispose();
+        m_persistedPluginWidget = nullptr;
+    }
+    HTMLFrameOwnerElement::disconnectContentFrame();
+}
+#endif
+
+void HTMLPlugInElement::setPersistedPluginWidget(Widget* widget)

[sof, 2014/10/08 11:52:25]

This scheme is not complete and doesn't solve the problematic case of having a
non-tree plugin element with a renderer-less plugin, with the element then
becoming unreachable and eventually swept.

For that case, we need to inject an explicit dispose of the underlying plugin
before the plugin element (and frame) goes away. There's no support for that
here, nor do I see how to achieve it.

It does address the case where the LocalFrame and plugin element die at the same
time, but not before the LocalFrame is detached.

+{
+#if ENABLE(OILPAN)
+    if (widget->isPluginView()) {
+        PluginView* plugin = toPluginView(widget);
+        if (LocalFrame* frame = plugin->pluginFrame()) {
+            frame->registerPluginElement(this);
+        }
+    }
+#endif
+    m_persistedPluginWidget = widget;
+}
+
 bool HTMLPlugInElement::canProcessDrag() const
 {
     return pluginWidget() && pluginWidget()->isPluginView() && toPluginView(pluginWidget())->canProcessDrag();
@@ -201,13 +226,10 @@ void HTMLPlugInElement::detach(const AttachContext& context)
     // Only try to persist a plugin widget we actually own.
     Widget* plugin = ownedWidget();
     if (plugin && plugin->pluginShouldPersist())
-        m_persistedPluginWidget = plugin;
-#if ENABLE(OILPAN)
-    else if (plugin)
-        plugin->detach();
-#endif
+        setPersistedPluginWidget(plugin);
+
     resetInstance();
-    // FIXME - is this next line necessary?
+    // Clear the widget; will trigger disposal of it with Oilpan.
     setWidget(nullptr);
 
     if (m_isCapturingMouseEvents) {
@@ -335,7 +357,7 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
         if (toRenderEmbeddedObject(r)->showsUnavailablePluginIndicator())
             return;
     }
-    RefPtr<Widget> widget = toRenderWidget(r)->widget();
+    RefPtrWillBeRawPtr<Widget> widget = toRenderWidget(r)->widget();
     if (!widget)
         return;
     widget->handleEvent(event);
@@ -478,7 +500,7 @@ bool HTMLPlugInElement::loadPlugin(const KURL& url, const String& mimeType, cons
     WTF_LOG(Plugins, "   Loaded URL: %s", url.string().utf8().data());
     m_loadedUrl = url;
 
-    RefPtr<Widget> widget = m_persistedPluginWidget;
+    RefPtrWillBeRawPtr<Widget> widget = m_persistedPluginWidget;
     if (!widget) {
         bool loadManually = document().isPluginDocument() && !document().containsPlugins();
         FrameLoaderClient::DetachedPluginPolicy policy = requireRenderer ? FrameLoaderClient::FailOnDetachedPlugin : FrameLoaderClient::AllowDetachedPlugin;
@@ -495,7 +517,7 @@ bool HTMLPlugInElement::loadPlugin(const KURL& url, const String& mimeType, cons
         setWidget(widget);
         m_persistedPluginWidget = nullptr;
     } else if (widget != m_persistedPluginWidget) {
-        m_persistedPluginWidget = widget;
+        setPersistedPluginWidget(widget.get());
     }
     document().setContainsPlugins();
     scheduleSVGFilterLayerUpdateHack();