Oilpan: move node/element rare data objects to the heap.

Source/core/dom/shadow/ElementShadow.cpp

 /*
  * Copyright (C) 2012 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Neither the name of Google Inc. nor the names of its
@@ skipping 145 matching lines @@
 
     InspectorInstrumentation::didPushShadowRoot(&shadowHost, shadowRoot.get());
 
     ASSERT(m_shadowRoots.head());
     ASSERT(shadowRoot.get() == m_shadowRoots.head());
     return *m_shadowRoots.head();
 }
 
 void ElementShadow::removeDetachedShadowRoots()
 {
+    // With Oilpan, the Element shadow roots may have been finalized
+    // during the same sweep. Do not access, but do the minimum
+    // necessary/allowed, just clearing the list of roots.
+#if !ENABLE(OILPAN)
     // Dont protect this ref count.
     Element* shadowHost = host();
     ASSERT(shadowHost);
+#endif
 
     while (RefPtr<ShadowRoot> oldRoot = m_shadowRoots.head()) {
+#if !ENABLE(OILPAN)
         InspectorInstrumentation::willPopShadowRoot(shadowHost, oldRoot.get());
         shadowHost->document().removeFocusedElementOfSubtree(oldRoot.get());
+#endif
         m_shadowRoots.removeHead();
         oldRoot->setParentOrShadowHostNode(0);
+#if !ENABLE(OILPAN)
         oldRoot->setParentTreeScope(shadowHost->document());
+#endif

[haraken, 2014/05/04 01:46:24]

This change is not related to this CL, and should have been committed when Mads
removed guardRefs? Then let's land this part before landing this CL.

[sof, 2014/05/04 18:59:22]

The need to be careful on what happens in the ElementShadow destructor is made
more prominent here.

         oldRoot->setPrev(0);
         oldRoot->setNext(0);
     }
-
 }
 
 void ElementShadow::attach(const Node::AttachContext& context)
 {
     Node::AttachContext childrenContext(context);
     childrenContext.resolvedStyle = 0;
 
     for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot()) {
         if (root->needsAttach())
             root->attach(childrenContext);
@@ skipping 154 matching lines @@
 
 void ElementShadow::clearDistribution()
 {
     m_nodeToInsertionPoints.clear();
 
     for (ShadowRoot* root = youngestShadowRoot(); root; root = root->olderShadowRoot())
         root->setShadowInsertionPointOfYoungerShadowRoot(nullptr);
 }
 
 } // namespace