Oilpan: move node/element rare data objects to the heap.

Source/core/dom/shadow/ElementShadow.cpp

Index: Source/core/dom/shadow/ElementShadow.cpp
diff --git a/Source/core/dom/shadow/ElementShadow.cpp b/Source/core/dom/shadow/ElementShadow.cpp
index ba11a7035476768c2f723cc0defafba3f50454b5..1cd754dc722e1fcb12caf329e571b608a06da2a7 100644
--- a/Source/core/dom/shadow/ElementShadow.cpp
+++ b/Source/core/dom/shadow/ElementShadow.cpp
@@ -163,20 +163,28 @@ ShadowRoot& ElementShadow::addShadowRoot(Element& shadowHost, ShadowRoot::Shadow
 
 void ElementShadow::removeDetachedShadowRoots()
 {
+    // With Oilpan, the Element shadow roots may have been finalized
+    // during the same sweep. Do not access, but do the minimum
+    // necessary/allowed, just clearing the list of roots.
+#if !ENABLE(OILPAN)
     // Dont protect this ref count.
     Element* shadowHost = host();
     ASSERT(shadowHost);
+#endif
 
     while (RefPtr<ShadowRoot> oldRoot = m_shadowRoots.head()) {
+#if !ENABLE(OILPAN)
         InspectorInstrumentation::willPopShadowRoot(shadowHost, oldRoot.get());
         shadowHost->document().removeFocusedElementOfSubtree(oldRoot.get());
+#endif
         m_shadowRoots.removeHead();
         oldRoot->setParentOrShadowHostNode(0);
+#if !ENABLE(OILPAN)
         oldRoot->setParentTreeScope(shadowHost->document());
+#endif

[haraken, 2014/05/04 01:46:24]

This change is not related to this CL, and should have been committed when Mads
removed guardRefs? Then let's land this part before landing this CL.

[sof, 2014/05/04 18:59:22]

The need to be careful on what happens in the ElementShadow destructor is made
more prominent here.

         oldRoot->setPrev(0);
         oldRoot->setNext(0);
     }
-
 }
 
 void ElementShadow::attach(const Node::AttachContext& context)