Oilpan: make XHR progress event throttling finalization safe.

Move the XHR event throttling object to the heap. It is a timer object,
hence it must be eagerly finalized so as to prevent unsafe accesses
should it instead be lazy sweepable.

Part objects cannot be eagerly finalized on their own, hence this is
accomplished by moving the object to the heap. For simplicity, we keep
it as a separate heap object non-Oilpan also.

R=haraken
BUG=491488

Review URL: https://codereview.chromium.org/1200413004

git-svn-id: svn://svn.chromium.org/blink/trunk@197904 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.cpp

@@ -346,7 +346,7 @@ XMLHttpRequest::XMLHttpRequest(ExecutionContext* context, PassRefPtr<SecurityOri
     , m_lengthDownloadedToFile(0)
     , m_receivedLength(0)
     , m_exceptionCode(0)
-    , m_progressEventThrottle(this)
+    , m_progressEventThrottle(XMLHttpRequestProgressEventThrottle::create(this))
     , m_responseTypeCode(ResponseTypeDefault)
     , m_securityOrigin(securityOrigin)
     , m_eventDispatchRecursionLevel(0)
@@ -673,7 +673,7 @@ void XMLHttpRequest::dispatchReadyStateChangeEvent()
             else
                 action = XMLHttpRequestProgressEventThrottle::Flush;
         }
-        m_progressEventThrottle.dispatchReadyStateChangeEvent(Event::create(EventTypeNames::readystatechange), action);
+        m_progressEventThrottle->dispatchReadyStateChangeEvent(Event::create(EventTypeNames::readystatechange), action);
         TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"), "UpdateCounters", TRACE_EVENT_SCOPE_THREAD, "data", InspectorUpdateCountersEvent::data());
     }
 
@@ -1222,7 +1222,7 @@ void XMLHttpRequest::dispatchProgressEvent(const AtomicString& type, long long r
     unsigned long long loaded = receivedLength >= 0 ? static_cast<unsigned long long>(receivedLength) : 0;
     unsigned long long total = lengthComputable ? static_cast<unsigned long long>(expectedLength) : 0;
 
-    m_progressEventThrottle.dispatchProgressEvent(type, lengthComputable, loaded, total);
+    m_progressEventThrottle->dispatchProgressEvent(type, lengthComputable, loaded, total);
 
     if (type == EventTypeNames::loadend)
         InspectorInstrumentation::didDispatchXHRLoadendEvent(executionContext(), this);
@@ -1807,12 +1807,12 @@ void XMLHttpRequest::handleDidTimeout()
 
 void XMLHttpRequest::suspend()
 {
-    m_progressEventThrottle.suspend();
+    m_progressEventThrottle->suspend();
 }
 
 void XMLHttpRequest::resume()
 {
-    m_progressEventThrottle.resume();
+    m_progressEventThrottle->resume();
 }
 
 void XMLHttpRequest::stop()

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequest.h

@@ -254,6 +254,8 @@ private:
 
     void handleRequestError(ExceptionCode, const AtomicString&, long long, long long);
 
+    XMLHttpRequestProgressEventThrottle& progressEventThrottle();
+
     OwnPtrWillBeMember<XMLHttpRequestUpload> m_upload;
 
     KURL m_url;
@@ -293,7 +295,7 @@ private:
     // any.
     ExceptionCode m_exceptionCode;
 
-    XMLHttpRequestProgressEventThrottle m_progressEventThrottle;
+    OwnPtrWillBeMember<XMLHttpRequestProgressEventThrottle> m_progressEventThrottle;
 
     // An enum corresponding to the allowed string values for the responseType attribute.
     ResponseTypeCode m_responseTypeCode;

third_party/WebKit/Source/core/xmlhttprequest/XMLHttpRequestProgressEventThrottle.h

@@ -49,18 +49,20 @@ class EventTarget;
 // - "progress" event means an event named "progress"
 // - ProgressEvent means an event using the ProgressEvent interface defined in
 //   the spec.
-class XMLHttpRequestProgressEventThrottle final : public TimerBase {
-    DISALLOW_ALLOCATION();
+class XMLHttpRequestProgressEventThrottle final : public NoBaseWillBeGarbageCollectedFinalized<XMLHttpRequestProgressEventThrottle>, public TimerBase {
 public:
+    static PassOwnPtrWillBeRawPtr<XMLHttpRequestProgressEventThrottle> create(EventTarget* eventTarget)
+    {
+        return adoptPtrWillBeNoop(new XMLHttpRequestProgressEventThrottle(eventTarget));
+    }
+    virtual ~XMLHttpRequestProgressEventThrottle();
+
     enum DeferredEventAction {
         Ignore,
         Clear,
         Flush,
     };
 
-    explicit XMLHttpRequestProgressEventThrottle(EventTarget*);
-    virtual ~XMLHttpRequestProgressEventThrottle();
-
     // Dispatches a ProgressEvent.
     //
     // Special treatment for events named "progress" is implemented to dispatch
@@ -77,9 +79,13 @@ public:
     void suspend();
     void resume();
 
+    // Need to promptly stop this timer when it is deemed finalizable.
+    EAGERLY_FINALIZE();
     DECLARE_TRACE();
 
 private:
+    explicit XMLHttpRequestProgressEventThrottle(EventTarget*);
+
     // The main purpose of this class is to throttle the "progress"
     // ProgressEvent dispatching. This class represents such a deferred
     // "progress" ProgressEvent.