Oilpan: move node/element rare data objects to the heap.

Source/core/dom/MutationObserver.cpp

 /*
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 52 matching lines @@
 
 MutationObserver::MutationObserver(PassOwnPtr<MutationCallback> callback)
     : m_callback(callback)
     , m_priority(s_observerPriority++)
 {
     ScriptWrappable::init(this);
 }
 
 MutationObserver::~MutationObserver()
 {
+#if !ENABLE(OILPAN)
     ASSERT(m_registrations.isEmpty());

[zerny-chromium, 2014/05/05 07:50:18]

Did this assert actually change? (can it be non empty?). If not, I think it
should still be safe to call isEmpty. (We can use collection methods if they not
require the backing be alive.)

[sof, 2014/05/05 08:48:51]

It has changed as a result of Node (and NodeRareData) no longer being allowed to
dispose of NodeMutationObserverData when finalized. Consequently, any
MutationObserverRegistration therein will not unregister with its Observer
either & the above assert will now not hold in an Oilpan setting.

[Erik Corry, 2014/05/05 09:31:27]

But you removed the dispose of this from NodeRareData even in non-oilpan mode,
so how does this assert pass in non-oilpan mode?

[sof, 2014/05/05 09:40:03]

The rare data is deleted => the rare data OwnPtr deletes its
NodeMutationObserverData => MutationObserverRegistration is destructed =>
dispose() is called on the attached observer & it derefs its MutationObserver =>
the MutationObserver is destructed on ref count hitting 0 => no registrations
left.

IOW, there are no one-step dependencies when it comes to mutation observers.

+#endif
     if (!m_records.isEmpty())
         InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
 }
 
 void MutationObserver::observe(Node* node, const Dictionary& optionsDictionary, ExceptionState& exceptionState)
 {
     if (!node) {
         exceptionState.throwDOMException(NotFoundError, "The provided node was null.");
         return;
     }
@@ skipping 199 matching lines @@
     }
 }
 
 void MutationObserver::trace(Visitor* visitor)
 {
     visitor->trace(m_records);
     visitor->trace(m_registrations);
 }
 
 } // namespace WebCore