Oilpan: move node/element rare data objects to the heap.

Source/core/html/forms/TextFieldInputType.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  * Copyright (C) 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
@@ skipping 97 matching lines @@
 
 };
 
 TextFieldInputType::TextFieldInputType(HTMLInputElement& element)
     : InputType(element)
 {
 }
 
 TextFieldInputType::~TextFieldInputType()
 {
+#if !ENABLE(OILPAN)
     if (SpinButtonElement* spinButton = spinButtonElement())
         spinButton->removeSpinButtonOwner();
+#endif

[haraken, 2014/05/04 01:46:24]

This part is not related to this CL, and should have been committed when Mads
removed guardRefs? Then let's comment this part before landing this CL.

[sof, 2014/05/04 18:59:22]

The reason why it's here in this CL is that it causes TextFieldInputType to
access its element's UA shadow root element, which might be finalized already.

The unordered finalization of an Element and its ElementRareData (holding the
ElementShadow) is behind this; hence its inclusion here.

 }
 
 SpinButtonElement* TextFieldInputType::spinButtonElement() const
 {
     return toSpinButtonElement(element().userAgentShadowRoot()->getElementById(ShadowElementNames::spinButton()));
 }
 
 bool TextFieldInputType::shouldShowFocusRingOnMouseFocus() const
 {
     return true;
@@ skipping 435 matching lines @@
     return shouldSpinButtonRespondToMouseEvents() && element().focused();
 }
 
 void TextFieldInputType::spinButtonDidReleaseMouseCapture(SpinButtonElement::EventDispatch eventDispatch)
 {
     if (eventDispatch == SpinButtonElement::EventDispatchAllowed)
         element().dispatchFormControlChangeEvent();
 }
 
 } // namespace WebCore