Oilpan: move node/element rare data objects to the heap.

Source/core/animation/ActiveAnimations.h

Index: Source/core/animation/ActiveAnimations.h
diff --git a/Source/core/animation/ActiveAnimations.h b/Source/core/animation/ActiveAnimations.h
index 1a4c0a0bb119a4b2f93e11c8cf203ba90549652f..fba5d552f0abf9e8ebdf4ee497a7a4fcb18296df 100644
--- a/Source/core/animation/ActiveAnimations.h
+++ b/Source/core/animation/ActiveAnimations.h
@@ -53,7 +53,6 @@ public:
     }
 
     ~ActiveAnimations();
-    void dispose();
 
     // Animations that are currently active for this element, their effects will be applied
     // during a style recalc. CSS Transitions are included in this stack.
@@ -94,6 +93,16 @@ private:
     // won't be needed once Element and Animation are moved to Oilpan.
     Vector<Animation*> m_animations;
 
+#if ENABLE(OILPAN)
+    // Keep a back reference to the target Element, so that this object
+    // will be finalized during the same GC sweep as the target (as the
+    // the Element keeps a reference in the other direction via its
+    // rare data.) This is done so that we can accurately notify the
+    // the Element as destroyed to the above vector of Animations in

[haraken, 2014/05/05 16:54:52]

the the Element => the Element

+    // the ActiveAnimations finalizer.
+    Member<Element> m_target;

[haraken, 2014/05/05 16:54:52]

Until Mads lands the CL that makes the Node hierarchy traceable, the
Member<Element> just keeps the Element alive and doesn't keep other Nodes in the
tree alive. This will lead to wrong behavior, but I'm OK with it since the issue
will be resolved shortly once Mads's CL lands.

Let's add a FIXME about it. (A bunch of complicated things are going on around
the Node hierarchy and core/animations/, so we want to be clear about what we're
missing :-)

+#endif
+
     // CSSAnimations checks if a style change is due to animation.
     friend class CSSAnimations;
 };