Oilpan: KeyframeEffect::m_target shouldn't become stale

r201633 shipped oilpan for core/animations/, but I removed !ENABLE(OILPAN) code too much.
Some of them shouldn't be removed until we ship Oilpan for the Node hierarchy.

This CL recovers the code to clear KeyFrameEffect::m_target when the target Element gets destructed.

BUG=527520

Review URL: https://codereview.chromium.org/1322883003

git-svn-id: svn://svn.chromium.org/blink/trunk@201715 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/animation/ElementAnimations.cpp

@@ -42,7 +42,23 @@ ElementAnimations::ElementAnimations()
 
 ElementAnimations::~ElementAnimations()
 {
+#if !ENABLE(OILPAN)
+    ASSERT(m_effects.isEmpty());
+#endif
+}
+
+#if !ENABLE(OILPAN)
+void ElementAnimations::dispose()
+{
+    // The notifyElementDestroyed() is called for elements that happen to live
+    // longer than the KeyframeEffect. This undeterminism is fine because
+    // all the notifyElementDestroyed() does is to clear the raw pointers
+    // held by the KeyframeEffect.
+    for (KeyframeEffect* effect : m_effects)
+        effect->notifyElementDestroyed();
+    m_effects.clear();
 }
+#endif
 
 void ElementAnimations::updateAnimationFlags(ComputedStyle& style)
 {
@@ -88,6 +104,9 @@ DEFINE_TRACE(ElementAnimations)
     visitor->trace(m_cssAnimations);
     visitor->trace(m_defaultStack);
     visitor->trace(m_animations);
+#if !ENABLE(OILPAN)
+    visitor->trace(m_effects);
+#endif
 }
 
 const ComputedStyle* ElementAnimations::baseComputedStyle() const

third_party/WebKit/Source/core/animation/ElementAnimations.h

@@ -74,6 +74,11 @@ public:
     void updateBaseComputedStyle(const ComputedStyle*);
     void clearBaseComputedStyle();
 
+#if !ENABLE(OILPAN)
+    void addEffect(KeyframeEffect* effect) { m_effects.add(effect); }
+    void dispose();
+#endif
+
     DECLARE_TRACE();
 
 private:
@@ -85,6 +90,12 @@ private:
     bool m_animationStyleChange;
     RefPtr<ComputedStyle> m_baseComputedStyle;
 
+#if !ENABLE(OILPAN)
+    // TODO(oilpan): This is to avoid a reference cycle that keeps Elements
+    // alive and won't be needed once the Node hierarchy becomes traceable.
+    HeapHashSet<WeakMember<KeyframeEffect>> m_effects;
+#endif
+
     // CSSAnimations and DeferredLegacyStyleInterpolation checks if a style change is due to animation.
     friend class CSSAnimations;
     friend class DeferredLegacyStyleInterpolation;

third_party/WebKit/Source/core/animation/KeyframeEffect.cpp

@@ -83,6 +83,10 @@ KeyframeEffect::KeyframeEffect(Element* target, EffectModel* model, const Timing
     , m_sampledEffect(nullptr)
     , m_priority(priority)
 {
+#if !ENABLE(OILPAN)
+    if (m_target)
+        m_target->ensureElementAnimations().addEffect(this);
+#endif
 }
 
 KeyframeEffect::~KeyframeEffect()

third_party/WebKit/Source/core/dom/ElementRareData.h

@@ -172,6 +172,8 @@ inline ElementRareData::ElementRareData(LayoutObject* layoutObject)
 inline ElementRareData::~ElementRareData()
 {
 #if !ENABLE(OILPAN)
+    if (m_elementAnimations)
+        m_elementAnimations->dispose();
     ASSERT(!m_shadow);
 #endif
     ASSERT(!m_generatedBefore);