Oilpan: cleanup based on review comments after removal of TreeShared.

Source/core/svg/SVGElementInstance.cpp

Index: Source/core/svg/SVGElementInstance.cpp
diff --git a/Source/core/svg/SVGElementInstance.cpp b/Source/core/svg/SVGElementInstance.cpp
index 75974cd4446e49289f11a3adb739b2fcbb93606e..00787578fa0cb05e565e3a877759d0239e902d46 100644
--- a/Source/core/svg/SVGElementInstance.cpp
+++ b/Source/core/svg/SVGElementInstance.cpp
@@ -119,15 +119,15 @@ SVGElementInstance::~SVGElementInstance()
 
 // It's important not to inline removedLastRef, because we don't want to inline the code to
 // delete an SVGElementInstance at each deref call site.
+#if !ENABLE(OILPAN)
 void SVGElementInstance::removedLastRef()
 {
-#if !ENABLE(OILPAN)
 #if SECURITY_ASSERT_ENABLED
     m_deletionHasBegun = true;
 #endif
     delete this;
-#endif
 }
+#endif
 
 void SVGElementInstance::detach()
 {
@@ -140,12 +140,11 @@ void SVGElementInstance::detach()
     // Deregister as instance for passed element, if we haven't already.
     if (shadowTreeElement() && m_element->instancesForElement().contains(shadowTreeElement()))
         m_element->removeInstanceMapping(this);
-    // DO NOT clear ref to m_element because JavaScriptCore uses it for garbage collection
 
     m_shadowTreeElement = nullptr;
 
-    m_directUseElement = 0;
-    m_correspondingUseElement = 0;
+    m_directUseElement = nullptr;
+    m_correspondingUseElement = nullptr;
 
 #if !ENABLE(OILPAN)
     removeDetachedChildrenInContainer<SVGElementInstance, SVGElementInstance>(*this);
@@ -227,6 +226,8 @@ EventTargetData& SVGElementInstance::ensureEventTargetData()
 void SVGElementInstance::trace(Visitor* visitor)
 {
     visitor->trace(m_parentInstance);
+    visitor->trace(m_correspondingUseElement);
+    visitor->trace(m_directUseElement);
     visitor->trace(m_element);
     visitor->trace(m_shadowTreeElement);
     visitor->trace(m_previousSibling);