Have ProcessingInstruction's XSLT event listener keep a weak backreference

Source/core/xml/DocumentXSLT.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/xml/DocumentXSLT.h"
 
 #include "bindings/core/v8/DOMWrapperWorld.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/core/v8/V8AbstractEventListener.h"
 #include "bindings/core/v8/V8Binding.h"
 #include "core/dom/Document.h"
 #include "core/dom/Node.h"
 #include "core/dom/ProcessingInstruction.h"
 #include "core/events/Event.h"
 #include "core/events/EventListener.h"
 #include "core/frame/UseCounter.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/xml/XSLStyleSheet.h"
 #include "core/xml/XSLTProcessor.h"
 
 namespace blink {
 
-class DOMContentLoadedListener final : public V8AbstractEventListener {
+class DOMContentLoadedListener final : public ProcessingInstruction::DetachableEventListener, public V8AbstractEventListener {
 public:
+    static PassRefPtr<DOMContentLoadedListener> create(ScriptState* scriptState, ProcessingInstruction* pi)
+    {
+        return adoptRef(new DOMContentLoadedListener(scriptState, pi));
+    }
+
+    using V8AbstractEventListener::ref;
+    using V8AbstractEventListener::deref;
+
     virtual bool operator==(const EventListener&)
     {
         return true;
     }
 
     virtual void handleEvent(ExecutionContext* context, Event* event)
     {
         ASSERT(RuntimeEnabledFeatures::xsltEnabled());
         ASSERT(event->type() == "DOMContentLoaded");
         ScriptState::Scope scope(scriptState());
 
         Document& document = *toDocument(context);
         ASSERT(!document.parsing());
 
         // Processing instruction (XML documents only).
         // We don't support linking to embedded CSS stylesheets,
         // see <https://bugs.webkit.org/show_bug.cgi?id=49281> for discussion.
         // Don't apply XSL transforms to already transformed documents.
         if (DocumentXSLT::hasTransformSourceDocument(document))
             return;
 
         ProcessingInstruction* pi = DocumentXSLT::findXSLStyleSheet(document);
         if (!pi || pi != m_processingInstruction || pi->isLoading())
             return;
         DocumentXSLT::applyXSLTransform(document, pi);
     }
 
-    static PassRefPtr<DOMContentLoadedListener> create(ScriptState* scriptState, ProcessingInstruction* pi)
+    virtual void detach() override
     {
-        return adoptRef(new DOMContentLoadedListener(scriptState, pi));
+        m_processingInstruction = nullptr;
+    }
+
+    virtual EventListener* toEventListener() override
+    {
+        return this;
     }
 
 private:
     DOMContentLoadedListener(ScriptState* scriptState, ProcessingInstruction* pi)
         : V8AbstractEventListener(false, scriptState)
         , m_processingInstruction(pi)
     {
     }
 
+    virtual void refDetachableEventListener() override { ref(); }
+    virtual void derefDetachableEventListener() override { deref(); }
+
     virtual v8::Local<v8::Value> callListenerFunction(v8::Handle<v8::Value> jsevent, Event*)
     {
         ASSERT_NOT_REACHED();
         return v8::Local<v8::Value>();
     }
 
-    RefPtrWillBePersistent<ProcessingInstruction> m_processingInstruction;
+    // If this event listener is attached to a ProcessingInstruction, keep a
+    // weak reference back to it. That ProcessingInstruction is responsible for
+    // detaching itself and clear out the reference.
+    //
+    // FIXME: Oilpan: when EventListener is on the heap, make this a WeakMember<>,
+    // which will remove the need for explicit detachment.
+    ProcessingInstruction* m_processingInstruction;
 };
 
 DocumentXSLT::DocumentXSLT()
     : m_transformSourceDocument(nullptr)
 {
 }
 
 void DocumentXSLT::applyXSLTransform(Document& document, ProcessingInstruction* pi)
 {
     ASSERT(!pi->isLoading());
@@ skipping 30 matching lines @@
 
 bool DocumentXSLT::processingInstructionInsertedIntoDocument(Document& document, ProcessingInstruction* pi)
 {
     if (!pi->isXSL())
         return false;
 
     if (!RuntimeEnabledFeatures::xsltEnabled() || !document.frame())
         return true;
 
     ScriptState* scriptState = ScriptState::forMainWorld(document.frame());
-    RefPtr<EventListener> listener = DOMContentLoadedListener::create(scriptState, pi);
+    RefPtr<DOMContentLoadedListener> listener = DOMContentLoadedListener::create(scriptState, pi);
     document.addEventListener(EventTypeNames::DOMContentLoaded, listener, false);
     ASSERT(!pi->eventListenerForXSLT());
-    pi->setEventListenerForXSLT(listener);
+    pi->setEventListenerForXSLT(listener.release());
     return true;
 }
 
 bool DocumentXSLT::processingInstructionRemovedFromDocument(Document& document, ProcessingInstruction* pi)
 {
     if (!pi->isXSL())
         return false;
 
     if (!pi->eventListenerForXSLT())
         return true;
@@ skipping 38 matching lines @@
     return *supplement;
 }
 
 void DocumentXSLT::trace(Visitor* visitor)
 {
     visitor->trace(m_transformSourceDocument);
     DocumentSupplement::trace(visitor);
 }
 
 } // namespace blink