Oilpan: move node/element rare data objects to the heap.

Source/core/dom/Element.cpp

Index: Source/core/dom/Element.cpp
diff --git a/Source/core/dom/Element.cpp b/Source/core/dom/Element.cpp
index 08b8d3ed6a9655b519f22145c83b2d22850a822c..a93fdc4b3f67b54af5227a44a99687ff1c6ec3d9 100644
--- a/Source/core/dom/Element.cpp
+++ b/Source/core/dom/Element.cpp
@@ -167,11 +167,10 @@ Element::~Element()
 {
     ASSERT(needsAttach());
 
+#if !ENABLE(OILPAN)
     if (hasRareData())
         elementRareData()->clearShadow();
-
-    if (hasActiveAnimations())
-        activeAnimations()->dispose();

[Erik Corry, 2014/05/05 09:31:27]

It seems this could be kept inside the ifdef instead of being deleted.  By
removing it, you are forcing the reviewer to check that the active animations
can never outlive the element in non-oilpan mode. This is hard work, and if we
get it wrong we have introduced a security issue. Whereas if we just leave this
in it will disappear anyway when Oilpan lands.

[sof, 2014/05/05 13:38:58]

Sorry, but this explicit dispose() call was a very recent addition for Oilpan
purposes, which I'm now just undoing.

As the CL stands here, I don't see the value of having dispose() around any
longer, as we would have to call it from the dtor also in the Oilpan case (but
cannot call it from here in that case, of course.)

+#endif
 
     if (isCustomElement())
         CustomElement::wasDestroyed(this);
@@ -1430,7 +1429,7 @@ void Element::detach(const AttachContext& context)
 
         if (ActiveAnimations* activeAnimations = data->activeAnimations()) {
             if (context.performingReattach) {
-                // FIXME: We call detach from withing style recalc, so compositingState is not up to date.
+                // FIXME: We call detach from within style recalc, so compositingState is not up to date.
                 // https://code.google.com/p/chromium/issues/detail?id=339847
                 DisableCompositingQueryAsserts disabler;