Move FontPreloadManager to Oilpan

Currently, TimerBase cannot correctly track the lifetime of objects
embedded in GC-ed objects, like FontPreloadManager which is embedded in
Document. This causes some memory safety issues.

This patch moves FontPreloadManager to Oilpan to avoid the issue.

Bug: 1154965
Change-Id: I490b416abc6a997034baaa7994cd3a50bca7e055
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2611755Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Xiaocheng Hu <xiaochengh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#841039}

third_party/blink/renderer/core/dom/document.cc

@@ -816,7 +816,7 @@ Document::Document(const DocumentInit& initializer,
       fragment_directive_(MakeGarbageCollected<FragmentDirective>()),
       display_lock_document_state_(
           MakeGarbageCollected<DisplayLockDocumentState>(this)),
-      font_preload_manager_(*this),
+      font_preload_manager_(MakeGarbageCollected<FontPreloadManager>(*this)),
       data_(MakeGarbageCollected<DocumentData>(GetExecutionContext())) {
   if (GetFrame()) {
     DCHECK(GetFrame()->GetPage());
@@ -6947,7 +6947,7 @@ void Document::BeginLifecycleUpdatesIfRenderingReady() {
     return;
   if (!HaveRenderBlockingResourcesLoaded())
     return;
-  font_preload_manager_.WillBeginRendering();
+  font_preload_manager_->WillBeginRendering();
   View()->BeginLifecycleUpdates();
 }
 
@@ -7651,7 +7651,7 @@ bool Document::HaveScriptBlockingStylesheetsLoaded() const {
 bool Document::HaveRenderBlockingResourcesLoaded() const {
   return HaveImportsLoaded() &&
          style_engine_->HaveRenderBlockingStylesheetsLoaded() &&
-         !font_preload_manager_.HasPendingRenderBlockingFonts();
+         !font_preload_manager_->HasPendingRenderBlockingFonts();
 }
 
 Locale& Document::GetCachedLocale(const AtomicString& locale) {
@@ -8415,7 +8415,7 @@ void Document::ClearUseCounterForTesting(mojom::WebFeature feature) {
 }
 
 void Document::FontPreloadingFinishedOrTimedOut() {
-  DCHECK(!font_preload_manager_.HasPendingRenderBlockingFonts());
+  DCHECK(!font_preload_manager_->HasPendingRenderBlockingFonts());
   if (IsA<HTMLDocument>(this) && body()) {
     // For HTML, we resume only when we're past the body tag, so that we should
     // have something to paint now.

third_party/blink/renderer/core/dom/document.h

@@ -1628,7 +1628,7 @@ class CORE_EXPORT Document : public ContainerNode,
                                  unsigned new_length);
   void NotifyChangeChildren(const ContainerNode& container);
 
-  FontPreloadManager& GetFontPreloadManager() { return font_preload_manager_; }
+  FontPreloadManager& GetFontPreloadManager() { return *font_preload_manager_; }
   void FontPreloadingFinishedOrTimedOut();
 
   void IncrementAsyncScriptCount() { async_script_count_++; }
@@ -2184,7 +2184,7 @@ class CORE_EXPORT Document : public ContainerNode,
   // call or potential user prompt.
   bool expressly_denied_storage_access_ = false;
 
-  FontPreloadManager font_preload_manager_;
+  Member<FontPreloadManager> font_preload_manager_;
 
   int async_script_count_ = 0;
   bool first_paint_recorded_ = false;

third_party/blink/renderer/core/loader/font_preload_manager.h

@@ -20,9 +20,8 @@ class ResourceFinishObserver;
 // API) and notifies the relevant document, so that it can manage the first
 // rendering timing to work with preloaded fonts.
 // Design doc: https://bit.ly/36E8UKB
-class CORE_EXPORT FontPreloadManager final {
-  DISALLOW_NEW();
-
+class CORE_EXPORT FontPreloadManager final
+    : public GarbageCollected<FontPreloadManager> {
  public:
   explicit FontPreloadManager(Document&);
   ~FontPreloadManager() = default;