Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/NodeRareData.cpp

Index: Source/core/dom/NodeRareData.cpp
diff --git a/Source/core/dom/NodeRareData.cpp b/Source/core/dom/NodeRareData.cpp
index e3ee7e6d8a1190ad05ff54042d337417c73b0777..16d08d868e07345d8db7bbd2f3eeca7e8e91a76f 100644
--- a/Source/core/dom/NodeRareData.cpp
+++ b/Source/core/dom/NodeRareData.cpp
@@ -31,11 +31,13 @@
 #include "config.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/Element.h"
+#include "platform/heap/Handle.h"
 
 namespace WebCore {
 
 struct SameSizeAsNodeRareData {
-    void* m_pointer[3];
+    void* m_pointer[2];
+    OwnPtrWillBePersistent<NodeMutationObserverData> m_mutationObserverData;
     unsigned m_bitfields;
 };
 
@@ -55,6 +57,17 @@ void NodeListsNodeData::invalidateCaches(const QualifiedName* attrName)
         it->value->invalidateCache();
 }
 
+#if ENABLE(OILPAN)
+void NodeRareData::dispose()
+{
+    if (m_mutationObserverData) {
+        for (unsigned i = 0; i < m_mutationObserverData->registry.size(); i++)
+            m_mutationObserverData->registry.at(i)->dispose();
+        m_mutationObserverData.clear();

[haraken, 2014/04/17 05:37:12]

At this point, is it guaranteed that NodeMutationObserverData::transientRegistry
is empty? I wonder if it's guaranteed that all registries are correctly
unregistered from transientRegistry. Otherwise, it looks unsafe to call
MutationObserverRegistry::dispose() here, because transientRegistry still holds
a strong reference to the registries.

[sof, 2014/04/17 12:41:55]

That condition (an empty transient registry) is asserted for when starting to
clear out a Node's rare data. Which is the only place we call
NodeRareData::dispose() from.

[haraken, 2014/04/17 13:20:54]

Makes sense.

+    }
+}
+#endif
+
 // Ensure the 10 bits reserved for the m_connectedFrameCount cannot overflow
 COMPILE_ASSERT(Page::maxNumberOfFrames < (1 << NodeRareData::ConnectedFrameCountBits), Frame_limit_should_fit_in_rare_data_count);