Oilpan: Move WebFrameWidgetImpl into Oilpan heap.

The allocation and deallocation scheme of this class' instance is a bit
unusual, because these instances are passed to the Chromium side. The contract
between Chromium and us is basically: "call close() when you finish using it".
WebFrameWidgetImpl::create() calls leakRef() to keep the object alive, and
WebFrameWidgetImpl::close() does deref() to free up the object.

To mimic this keep-alive semantics in the Oilpan world, SelfKeepAlive<> is
used.

This patch fixes a raw pointer in WebFrameWidgetImpl.

BUG=509911
R=haraken@chromium.org, oilpan-reviews@chromium.org, sigbjornf@opera.com

Review URL: https://codereview.chromium.org/1294293004

git-svn-id: svn://svn.chromium.org/blink/trunk@200800 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/web/WebFrameWidgetImpl.cpp

@@ -73,7 +73,11 @@ WebFrameWidget* WebFrameWidget::create(WebView* webView)
 WebFrameWidgetImpl* WebFrameWidgetImpl::create(WebWidgetClient* client, WebLocalFrame* localRoot)
 {
     // Pass the WebFrameWidgetImpl's self-reference to the caller.
+#if ENABLE(OILPAN)
+    return new WebFrameWidgetImpl(client, localRoot); // SelfKeepAlive is set in constructor.
+#else
     return adoptRef(new WebFrameWidgetImpl(client, localRoot)).leakRef();
+#endif
 }
 
 // static
@@ -93,6 +97,9 @@ WebFrameWidgetImpl::WebFrameWidgetImpl(WebWidgetClient* client, WebLocalFrame* l
     , m_layerTreeViewClosed(false)
     , m_suppressNextKeypressEvent(false)
     , m_ignoreInputEvents(false)
+#if ENABLE(OILPAN)
+    , m_selfKeepAlive(this)
+#endif
 {
     ASSERT(m_localRoot->frame()->isLocalRoot());
     initializeLayerTreeView();
@@ -104,6 +111,12 @@ WebFrameWidgetImpl::~WebFrameWidgetImpl()
 {
 }
 
+DEFINE_TRACE(WebFrameWidgetImpl)
+{
+    visitor->trace(m_localRoot);
+    visitor->trace(m_mouseCaptureNode);
+}
+
 // WebWidget ------------------------------------------------------------------
 
 void WebFrameWidgetImpl::close()
@@ -118,7 +131,15 @@ void WebFrameWidgetImpl::close()
     // deleted.
     m_client = nullptr;
 
+    m_layerTreeView = nullptr;
+    m_rootLayer = nullptr;
+    m_rootGraphicsLayer = nullptr;
+
+#if ENABLE(OILPAN)
+    m_selfKeepAlive.clear();
+#else
     deref(); // Balances ref() acquired in WebFrameWidget::create
+#endif
 }
 
 WebSize WebFrameWidgetImpl::size()

third_party/WebKit/Source/web/WebFrameWidgetImpl.h

@@ -58,9 +58,9 @@ class WebLayerTreeView;
 class WebMouseEvent;
 class WebMouseWheelEvent;
 
-class WebFrameWidgetImpl final : public WebFrameWidget
-    , public PageWidgetEventHandler
-    , public RefCounted<WebFrameWidgetImpl> {
+class WebFrameWidgetImpl final : public RefCountedWillBeGarbageCollectedFinalized<WebFrameWidgetImpl>
+    , public WebFrameWidget
+    , public PageWidgetEventHandler {
 public:
     static WebFrameWidgetImpl* create(WebWidgetClient*, WebLocalFrame*);
     static HashSet<WebFrameWidgetImpl*>& allInstances();
@@ -148,9 +148,15 @@ public:
         ScrollDirection*,
         ScrollGranularity*);
 
+    DECLARE_TRACE();
+
 private:
     friend class WebFrameWidget; // For WebFrameWidget::create.
+#if ENABLE(OILPAN)
+    friend class GarbageCollectedFinalized<WebFrameWidgetImpl>;
+#else
     friend class WTF::RefCounted<WebFrameWidgetImpl>;
+#endif
 
     explicit WebFrameWidgetImpl(WebWidgetClient*, WebLocalFrame*);
     ~WebFrameWidgetImpl();
@@ -185,12 +191,12 @@ private:
 
     // WebFrameWidget is associated with a subtree of the frame tree, corresponding to a maximal
     // connected tree of LocalFrames. This member points to the root of that subtree.
-    WebLocalFrameImpl* m_localRoot;
+    RawPtrWillBeMember<WebLocalFrameImpl> m_localRoot;
 
     WebSize m_size;
 
     // If set, the (plugin) node which has mouse capture.
-    RefPtrWillBePersistent<Node> m_mouseCaptureNode;
+    RefPtrWillBeMember<Node> m_mouseCaptureNode;
     RefPtr<UserGestureToken> m_mouseCaptureGestureToken;
 
     WebLayerTreeView* m_layerTreeView;
@@ -204,6 +210,10 @@ private:
     bool m_ignoreInputEvents;
 
     static const WebInputEvent* m_currentInputEvent;
+
+#if ENABLE(OILPAN)
+    SelfKeepAlive<WebFrameWidgetImpl> m_selfKeepAlive;
+#endif
 };
 
 DEFINE_TYPE_CASTS(WebFrameWidgetImpl, WebFrameWidget, widget, widget->forSubframe(), widget.forSubframe());