Fix non-Oilpan ref pointer usage over DOMTokenLists.

third_party/WebKit/Source/core/dom/ElementRareData.h

Index: third_party/WebKit/Source/core/dom/ElementRareData.h
diff --git a/third_party/WebKit/Source/core/dom/ElementRareData.h b/third_party/WebKit/Source/core/dom/ElementRareData.h
index d09bff66af84005a95faa308b3e7c94292e0ac52..f243985db250768f520cd9acad36dcc3ede98ea8 100644
--- a/third_party/WebKit/Source/core/dom/ElementRareData.h
+++ b/third_party/WebKit/Source/core/dom/ElementRareData.h
@@ -88,7 +88,7 @@ public:
     void clearComputedStyle() { m_computedStyle = nullptr; }
 
     ClassList* classList() const { return m_classList.get(); }
-    void setClassList(PassRefPtrWillBeRawPtr<ClassList> classList) { m_classList = classList; }
+    void setClassList(PassRefPtrWillBeRawPtr<ClassList> classList) { m_classList = classList.leakRef(); }
     void clearClassListValueForQuirksMode()
     {
         if (!m_classList)
@@ -146,7 +146,7 @@ private:
 
     OwnPtrWillBeMember<DatasetDOMStringMap> m_dataset;
     OwnPtrWillBeMember<ElementShadow> m_shadow;
-    RefPtrWillBeMember<ClassList> m_classList;
+    RawPtrWillBeMember<ClassList> m_classList;
     OwnPtrWillBeMember<NamedNodeMap> m_attributeMap;
     OwnPtrWillBeMember<AttrNodeList> m_attrNodeList;
     OwnPtrWillBeMember<InlineCSSStyleDeclaration> m_cssomWrapper;
@@ -175,6 +175,7 @@ inline ElementRareData::ElementRareData(LayoutObject* layoutObject)
     : NodeRareData(layoutObject)
     , m_tabindex(0)
     , m_minimumSizeForResizing(defaultMinimumSizeForResizing())
+    , m_classList(nullptr)
 {
     m_isElementRareData = true;
 }