Oilpan: move node/element rare data objects to the heap.

Source/core/dom/MutationObserver.cpp

Index: Source/core/dom/MutationObserver.cpp
diff --git a/Source/core/dom/MutationObserver.cpp b/Source/core/dom/MutationObserver.cpp
index d8ea3ddffc2835eb2ad3c661defa1b4dfb5b6f56..e36a1a7b243262d77d7a3ee733d7d72b8497f112 100644
--- a/Source/core/dom/MutationObserver.cpp
+++ b/Source/core/dom/MutationObserver.cpp
@@ -70,7 +70,9 @@ MutationObserver::MutationObserver(PassOwnPtr<MutationCallback> callback)
 
 MutationObserver::~MutationObserver()
 {
+#if !ENABLE(OILPAN)
     ASSERT(m_registrations.isEmpty());

[zerny-chromium, 2014/05/05 07:50:18]

Did this assert actually change? (can it be non empty?). If not, I think it
should still be safe to call isEmpty. (We can use collection methods if they not
require the backing be alive.)

[sof, 2014/05/05 08:48:51]

It has changed as a result of Node (and NodeRareData) no longer being allowed to
dispose of NodeMutationObserverData when finalized. Consequently, any
MutationObserverRegistration therein will not unregister with its Observer
either & the above assert will now not hold in an Oilpan setting.

[Erik Corry, 2014/05/05 09:31:27]

But you removed the dispose of this from NodeRareData even in non-oilpan mode,
so how does this assert pass in non-oilpan mode?

[sof, 2014/05/05 09:40:03]

The rare data is deleted => the rare data OwnPtr deletes its
NodeMutationObserverData => MutationObserverRegistration is destructed =>
dispose() is called on the attached observer & it derefs its MutationObserver =>
the MutationObserver is destructed on ref count hitting 0 => no registrations
left.

IOW, there are no one-step dependencies when it comes to mutation observers.

+#endif
     if (!m_records.isEmpty())
         InspectorInstrumentation::didClearAllMutationRecords(m_callback->executionContext(), this);
 }