Oilpan: move node/element rare data objects to the heap.

Source/core/dom/MutationObserverRegistration.h

Index: Source/core/dom/MutationObserverRegistration.h
diff --git a/Source/core/dom/MutationObserverRegistration.h b/Source/core/dom/MutationObserverRegistration.h
index 7668c09b115c78a31a385dd3a26cf3a0bc468d6c..3e9ab794c6479587253a7388dc981648970ccc18 100644
--- a/Source/core/dom/MutationObserverRegistration.h
+++ b/Source/core/dom/MutationObserverRegistration.h
@@ -69,8 +69,10 @@ private:
     MutationObserverRegistration(MutationObserver&, Node&, MutationObserverOptions, const HashSet<AtomicString>& attributeFilter);
 
     RefPtrWillBeMember<MutationObserver> m_observer;
-    Node& m_registrationNode;
+    RawPtrWillBeMember<Node> m_registrationNode;
+#if !ENABLE(OILPAN)
     RefPtr<Node> m_registrationNodeKeepAlive;

[haraken, 2014/05/04 01:46:24]

We won't be able to remove this until we make the Node hierarchy traceable (by
the next change from Mads). Currently a Member to a Node X keeps X alive but
does not keep other Nodes in the same tree alive.

[sof, 2014/05/04 06:33:26]

Hmm, quite right. It might be an odd thing to test for, but no problems directly
relating to this seen. Leaving it in with a FIXME is an alternative without
waiting on that larger change, I think.

+#endif
     typedef HashSet<RefPtr<Node> > NodeHashSet;
     OwnPtr<NodeHashSet> m_transientRegistrationNodes;