Oilpan: move node/element rare data objects to the heap.

Source/core/animation/ActiveAnimations.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 35 matching lines @@
 
 class ActiveAnimations : public NoBaseWillBeGarbageCollectedFinalized<ActiveAnimations> {
     WTF_MAKE_NONCOPYABLE(ActiveAnimations);
 public:
     ActiveAnimations()
         : m_animationStyleChange(false)
     {
     }
 
     ~ActiveAnimations();
-    void dispose();
 
     // Animations that are currently active for this element, their effects will be applied
     // during a style recalc. CSS Transitions are included in this stack.
     AnimationStack& defaultStack() { return m_defaultStack; }
     // Tracks the state of active CSS Animations and Transitions. The individual animations
     // will also be part of the default stack, but the mapping betwen animation name and
     // player is kept here.
     CSSAnimations& cssAnimations() { return m_cssAnimations; }
     const CSSAnimations& cssAnimations() const { return m_cssAnimations; }
 
@@ skipping 20 matching lines @@
 
     AnimationStack m_defaultStack;
     CSSAnimations m_cssAnimations;
     AnimationPlayerCountedSet m_players;
     bool m_animationStyleChange;
 
     // This is to avoid a reference cycle that keeps Elements alive and
     // won't be needed once Element and Animation are moved to Oilpan.
     Vector<Animation*> m_animations;
 
+#if ENABLE(OILPAN)
+    // Keep a back reference to the target Element, so that we know
+    // that when this object is finalized, the Element will be dead
+    // too (=> disposing of the above Animations can be done
+    // correctly from our finalizer.)
+    Member<Element> m_target;

[haraken, 2014/05/04 01:46:24]

I don't fully understand why we need to add m_target here. Instead, probably
should we change Animation::m_target from a raw pointer to a Member?

[sof, 2014/05/04 18:59:22]

With it, you'll be able to accurately notify the Animations that the Element has
been destroyed in ~ActiveAnimations.

I didn't want to make more changes to animations/ than needed, given that its
Oilpan changes hasn't settled yet (and object relationships appear non-trivial
:) )

+#endif
+
     // CSSAnimations checks if a style change is due to animation.
     friend class CSSAnimations;
 };
 
 } // namespace WebCore
 
 #endif