Oilpan: move mutation observers to the Oilpan heap.

Source/core/dom/NodeRareData.cpp

Index: Source/core/dom/NodeRareData.cpp
diff --git a/Source/core/dom/NodeRareData.cpp b/Source/core/dom/NodeRareData.cpp
index e3ee7e6d8a1190ad05ff54042d337417c73b0777..3e6823f5e5799dd4a42f2279da58bb12ef3f51f6 100644
--- a/Source/core/dom/NodeRareData.cpp
+++ b/Source/core/dom/NodeRareData.cpp
@@ -31,11 +31,13 @@
 #include "config.h"
 #include "core/dom/NodeRareData.h"
 #include "core/dom/Element.h"
+#include "platform/heap/Handle.h"
 
 namespace WebCore {
 
 struct SameSizeAsNodeRareData {
-    void* m_pointer[3];
+    void* m_pointer[2];
+    OwnPtrWillBePersistent<NodeMutationObserverData> m_mutationObserverData;
     unsigned m_bitfields;
 };
 
@@ -55,6 +57,15 @@ void NodeListsNodeData::invalidateCaches(const QualifiedName* attrName)
         it->value->invalidateCache();
 }
 
+void NodeRareData::dispose()
+{
+    if (m_mutationObserverData) {
+        for (unsigned i = 0; i < m_mutationObserverData->registry.size(); i++)
+            m_mutationObserverData->registry.at(i)->dispose();
+        m_mutationObserverData.clear();
+    }
+}
+
 // Ensure the 10 bits reserved for the m_connectedFrameCount cannot overflow
 COMPILE_ASSERT(Page::maxNumberOfFrames < (1 << NodeRareData::ConnectedFrameCountBits), Frame_limit_should_fit_in_rare_data_count);