Oilpan: cleanup based on review comments after removal of TreeShared.

Source/core/svg/SVGElementInstance.cpp

 /*
  * Copyright (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  * Copyright (C) 2011 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 101 matching lines @@
 
 #if !ENABLE(OILPAN)
     // Call detach because we may be deleted directly if we are a child of a detached instance.
     detach();
     m_element = nullptr;
 #endif
 }
 
 // It's important not to inline removedLastRef, because we don't want to inline the code to
 // delete an SVGElementInstance at each deref call site.
+#if !ENABLE(OILPAN)
 void SVGElementInstance::removedLastRef()
 {
-#if !ENABLE(OILPAN)
 #if SECURITY_ASSERT_ENABLED
     m_deletionHasBegun = true;
 #endif
     delete this;
+}
 #endif
-}
 
 void SVGElementInstance::detach()
 {
     // Clear all pointers. When the node is detached from the shadow DOM it should be removed but,
     // due to ref counting, it may not be. So clear everything to avoid dangling pointers.
 
     for (SVGElementInstance* node = firstChild(); node; node = node->nextSibling())
         node->detach();
 
     // Deregister as instance for passed element, if we haven't already.
     if (shadowTreeElement() && m_element->instancesForElement().contains(shadowTreeElement()))
         m_element->removeInstanceMapping(shadowTreeElement());
-    // DO NOT clear ref to m_element because JavaScriptCore uses it for garbage collection
 
     m_shadowTreeElement = nullptr;
 
-    m_directUseElement = 0;
-    m_correspondingUseElement = 0;
+    m_directUseElement = nullptr;
+    m_correspondingUseElement = nullptr;
 
 #if !ENABLE(OILPAN)
     removeDetachedChildrenInContainer<SVGElementInstance, SVGElementInstance>(*this);
 #endif
 }
 
 void SVGElementInstance::setShadowTreeElement(SVGElement* element)
 {
     ASSERT(element);
     m_shadowTreeElement = element;
@@ skipping 61 matching lines @@
 {
     // EventTarget would use these methods if we were actually using its add/removeEventListener logic.
     // As we're forwarding those calls to the correspondingElement(), no one should ever call this function.
     ASSERT_NOT_REACHED();
     return *eventTargetData();
 }
 
 void SVGElementInstance::trace(Visitor* visitor)
 {
     visitor->trace(m_parentInstance);
+    visitor->trace(m_correspondingUseElement);
+    visitor->trace(m_directUseElement);
     visitor->trace(m_element);
     visitor->trace(m_shadowTreeElement);
     visitor->trace(m_previousSibling);
     visitor->trace(m_nextSibling);
     visitor->trace(m_firstChild);
     visitor->trace(m_lastChild);
 }
 
 }