Oilpan: move node/element rare data objects to the heap.

Source/core/animation/ActiveAnimations.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 35 matching lines @@
 
 class ActiveAnimations : public NoBaseWillBeGarbageCollectedFinalized<ActiveAnimations> {
     WTF_MAKE_NONCOPYABLE(ActiveAnimations);
 public:
     ActiveAnimations()
         : m_animationStyleChange(false)
     {
     }
 
     ~ActiveAnimations();
-    void dispose();
 
     // Animations that are currently active for this element, their effects will be applied
     // during a style recalc. CSS Transitions are included in this stack.
     AnimationStack& defaultStack() { return m_defaultStack; }
     // Tracks the state of active CSS Animations and Transitions. The individual animations
     // will also be part of the default stack, but the mapping betwen animation name and
     // player is kept here.
     CSSAnimations& cssAnimations() { return m_cssAnimations; }
     const CSSAnimations& cssAnimations() const { return m_cssAnimations; }
 
@@ skipping 20 matching lines @@
 
     AnimationStack m_defaultStack;
     CSSAnimations m_cssAnimations;
     AnimationPlayerCountedSet m_players;
     bool m_animationStyleChange;
 
     // This is to avoid a reference cycle that keeps Elements alive and
     // won't be needed once Element and Animation are moved to Oilpan.
     Vector<Animation*> m_animations;
 
+#if ENABLE(OILPAN)
+    // Keep a back reference to the target Element, so that this object
+    // will be finalized during the same GC sweep as the target (as the
+    // the Element keeps a reference in the other direction via its
+    // rare data.) This is done so that we can accurately notify the
+    // the Element as destroyed to the above vector of Animations in
+    // the ActiveAnimations finalizer.
+    Member<Element> m_target;
+#endif
+
     // CSSAnimations checks if a style change is due to animation.
     friend class CSSAnimations;
 };
 
 } // namespace WebCore
 
 #endif