Oilpan: Move the EventListener hierarchy to Oilpan's heap

Source/bindings/core/v8/V8LazyEventListener.h

 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 27 matching lines @@
 
 namespace blink {
 
 class Event;
 class Node;
 
 // V8LazyEventListener is a wrapper for a JavaScript code string that is compiled and evaluated when an event is fired.
 // A V8LazyEventListener is either a HTML or SVG event handler.
 class V8LazyEventListener final : public V8AbstractEventListener {
 public:
-    static PassRefPtr<V8LazyEventListener> create(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String& sourceURL, const TextPosition& position, Node* node, v8::Isolate* isolate)
+    static PassRefPtrWillBeRawPtr<V8LazyEventListener> create(const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String& sourceURL, const TextPosition& position, Node* node, v8::Isolate* isolate)
     {
-        return adoptRef(new V8LazyEventListener(isolate, functionName, eventParameterName, code, sourceURL, position, node));
+        return adoptRefWillBeNoop(new V8LazyEventListener(isolate, functionName, eventParameterName, code, sourceURL, position, node));
+    }
+
+    DEFINE_INLINE_VIRTUAL_TRACE()
+    {
+        visitor->trace(m_node);
+        V8AbstractEventListener::trace(visitor);
     }
 
 protected:
     void prepareListenerObject(ExecutionContext*) override;
 
 private:
     V8LazyEventListener(v8::Isolate*, const AtomicString& functionName, const AtomicString& eventParameterName, const String& code, const String sourceURL, const TextPosition&, Node*);
 
     v8::Local<v8::Value> callListenerFunction(ScriptState*, v8::Local<v8::Value>, Event*) override;
 
     // Needs to return true for all event handlers implemented in JavaScript so that
     // the SVG code does not add the event handler in both
     // SVGUseElement::buildShadowTree and again in
     // SVGUseElement::transferEventListenersToShadowTree
     bool wasCreatedFromMarkup() const override { return true; }
 
     AtomicString m_functionName;
     AtomicString m_eventParameterName;
     String m_code;
     String m_sourceURL;
-    Node* m_node;
+    RawPtrWillBeMember<Node> m_node;
     TextPosition m_position;
 };
 
 } // namespace blink
 
 #endif // V8LazyEventListener_h