Oilpan: move ScriptController+WindowProxy to the heap.

Source/bindings/core/v8/ScriptController.h

Index: Source/bindings/core/v8/ScriptController.h
diff --git a/Source/bindings/core/v8/ScriptController.h b/Source/bindings/core/v8/ScriptController.h
index dea90c48c28dd1aff2f4b233d70ecca44ee2fbd2..71d60f922dbf5952825c62bb51a2292d9130675d 100644
--- a/Source/bindings/core/v8/ScriptController.h
+++ b/Source/bindings/core/v8/ScriptController.h
@@ -34,8 +34,8 @@
 #include "bindings/core/v8/SharedPersistent.h"
 
 #include "core/fetch/CrossOriginAccessControl.h"
+#include "platform/heap/Handle.h"
 #include "wtf/HashMap.h"
-#include "wtf/RefCounted.h"
 #include "wtf/Vector.h"
 #include "wtf/text/TextPosition.h"
 #include <v8.h>
@@ -63,15 +63,20 @@ enum ReasonForCallingCanExecuteScripts {
     NotAboutToExecuteScript
 };
 
-class ScriptController {
+class ScriptController final : public NoBaseWillBeGarbageCollectedFinalized<ScriptController> {
 public:
     enum ExecuteScriptPolicy {
         ExecuteScriptWhenScriptsDisabled,
         DoNotExecuteScriptWhenScriptsDisabled
     };
 
-    ScriptController(LocalFrame*);
+    static PassOwnPtrWillBeRawPtr<ScriptController> create(LocalFrame* frame)
+    {
+        return adoptPtrWillBeNoop(new ScriptController(frame));
+    }
+
     ~ScriptController();
+    void trace(Visitor*);
 
     bool initializeMainWorld();
     WindowProxy* windowProxy(DOMWrapperWorld&);
@@ -147,16 +152,18 @@ public:
     v8::Isolate* isolate() const { return m_isolate; }
 
 private:
-    typedef HashMap<int, OwnPtr<WindowProxy> > IsolatedWorldMap;
+    explicit ScriptController(LocalFrame*);
+
+    typedef WillBeHeapHashMap<int, OwnPtrWillBeMember<WindowProxy> > IsolatedWorldMap;
     typedef HashMap<Widget*, NPObject*> PluginObjectMap;

[haraken, 2014/10/05 23:37:26]

Just to confirm: Are you sure that these raw pointers don't become stale
pointers when the ScriptController (on-heap) outlives Widgets or NPObjects
(off-heap)?

[sof, 2014/10/06 07:34:40]

Nothing changes wrt that; we do rely on plugins to clear out and unregister
their scripts (via the plugin container.) And that will still happen _and_
happen before this ScriptController (and its LocalFrame) is finalized.

I think this will remain workable once Widget (=> the plugin container) is moved
to the heap. If not, there's (even) more work to attend to there!

 
     v8::Local<v8::Value> evaluateScriptInMainWorld(const ScriptSourceCode&, AccessControlStatus, ExecuteScriptPolicy, double* compilationFinishTime = 0);
 
-    LocalFrame* m_frame;
+    RawPtrWillBeMember<LocalFrame> m_frame;
     const String* m_sourceURL;
     v8::Isolate* m_isolate;
 
-    OwnPtr<WindowProxy> m_windowProxy;
+    OwnPtrWillBeMember<WindowProxy> m_windowProxy;
     IsolatedWorldMap m_isolatedWorlds;
 
     // A mapping between Widgets and their corresponding script object.