Oilpan: Forbid adoptRef(X*) where X is RefCountedGarbageCollected

Once https://codereview.chromium.org/614373007/ lands, the following code doesn't work as expected (It confuses reference counting).

class X : public RefCountedGarbageCollected<X> {
  static PassRefPtr<X> create() {
    return adoptRef(new X);
  }
}

Instead we have to write:

class X : public RefCountedGarbageCollected<X> {
  static X* create() {
    return new X;
  }
}

This CL adds a compile-time verification to detect adoptRef(X*) where X is RefCountedGarbageCollected.

BUG=420515

Review URL: https://codereview.chromium.org/647393002

git-svn-id: svn://svn.chromium.org/blink/trunk@185124 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/rendering/ClipRects.h

@@ -27,10 +27,11 @@
 #define ClipRects_h
 
 #include "core/rendering/ClipRect.h"
+#include "wtf/RefCounted.h"
 
 namespace blink {
 
-class ClipRects {
+class ClipRects : public RefCounted<ClipRects> {
     WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<ClipRects> create()
@@ -44,8 +45,7 @@ public:
     }
 
     ClipRects()
-        : m_refCnt(1)
-        , m_fixed(0)
+        : m_fixed(0)
     {
     }
 
@@ -69,13 +69,6 @@ public:
     bool fixed() const { return static_cast<bool>(m_fixed); }
     void setFixed(bool fixed) { m_fixed = fixed ? 1 : 0; }
 
-    void ref() { m_refCnt++; }
-    void deref()
-    {
-        if (!--m_refCnt)
-            delete this;
-    }
-
     bool operator==(const ClipRects& other) const
     {
         return m_overflowClipRect == other.overflowClipRect()
@@ -98,7 +91,6 @@ private:
         : m_overflowClipRect(r)
         , m_fixedClipRect(r)
         , m_posClipRect(r)
-        , m_refCnt(1)
         , m_fixed(0)
     {
     }
@@ -107,7 +99,6 @@ private:
         : m_overflowClipRect(other.overflowClipRect())
         , m_fixedClipRect(other.fixedClipRect())
         , m_posClipRect(other.posClipRect())
-        , m_refCnt(1)
         , m_fixed(other.fixed())
     {
     }
@@ -115,8 +106,7 @@ private:
     ClipRect m_overflowClipRect;
     ClipRect m_fixedClipRect;
     ClipRect m_posClipRect;
-    unsigned m_refCnt : 31;
-    unsigned m_fixed : 1;
+    unsigned m_fixed;
 };
 
 } // namespace blink

third_party/WebKit/Source/core/rendering/RenderLayerClipper.cpp

@@ -113,8 +113,8 @@ ClipRects* RenderLayerClipper::clipRectsIfCached(const ClipRectsContext& context
     // This code is useful to check cached clip rects, but is too expensive to leave enabled in debug builds by default.
     ClipRectsContext tempContext(context);
     tempContext.cacheSlot = UncachedClipRects;
-    ClipRects clipRects;
-    calculateClipRects(tempContext, clipRects);
+    RefPtr<ClipRects> clipRects = ClipRects::create();
+    calculateClipRects(tempContext, *clipRects);
     ASSERT(clipRects == *entry.clipRects);
 #endif
 
@@ -153,9 +153,9 @@ ClipRects* RenderLayerClipper::getClipRects(const ClipRectsContext& context) con
     if (context.rootLayer != m_renderer.layer() && m_renderer.layer()->parent())
         parentClipRects = m_renderer.layer()->parent()->clipper().getClipRects(context);
 
-    ClipRects clipRects;
-    calculateClipRects(context, clipRects);
-    return storeClipRectsInCache(context, parentClipRects, clipRects);
+    RefPtr<ClipRects> clipRects = ClipRects::create();
+    calculateClipRects(context, *clipRects);
+    return storeClipRectsInCache(context, parentClipRects, *clipRects);
 }
 
 void RenderLayerClipper::clearClipRectsIncludingDescendants()
@@ -325,16 +325,16 @@ ClipRect RenderLayerClipper::backgroundClipRect(const ClipRectsContext& context)
     ASSERT(m_renderer.layer()->parent());
     ASSERT(m_renderer.view());
 
-    ClipRects parentClipRects;
+    RefPtr<ClipRects> parentClipRects = ClipRects::create();
     if (m_renderer.layer() == context.rootLayer)
-        parentClipRects.reset(PaintInfo::infiniteRect());
+        parentClipRects->reset(PaintInfo::infiniteRect());
     else
-        m_renderer.layer()->parent()->clipper().getOrCalculateClipRects(context, parentClipRects);
+        m_renderer.layer()->parent()->clipper().getOrCalculateClipRects(context, *parentClipRects);
 
-    ClipRect result = backgroundClipRectForPosition(parentClipRects, m_renderer.style()->position());
+    ClipRect result = backgroundClipRectForPosition(*parentClipRects, m_renderer.style()->position());
 
     // Note: infinite clipRects should not be scrolled here, otherwise they will accidentally no longer be considered infinite.
-    if (parentClipRects.fixed() && context.rootLayer->renderer() == m_renderer.view() && result != PaintInfo::infiniteRect())
+    if (parentClipRects->fixed() && context.rootLayer->renderer() == m_renderer.view() && result != PaintInfo::infiniteRect())
         result.move(m_renderer.view()->frameView()->scrollOffsetForFixedPosition());
 
     return result;

third_party/WebKit/Source/platform/heap/Handle.h

@@ -1152,6 +1152,9 @@ template<typename T>
 struct ParamStorageTraits<RawPtr<T> > : public PointerParamStorageTraits<T*, blink::IsGarbageCollectedType<T>::value> {
 };
 
+template<typename T>
+PassRefPtr<T> adoptRef(blink::RefCountedGarbageCollected<T>*) = delete;
+
 } // namespace WTF
 
 #endif