Oilpan: move LiveNodeList collections to the heap.

Source/core/dom/NodeRareData.cpp

Index: Source/core/dom/NodeRareData.cpp
diff --git a/Source/core/dom/NodeRareData.cpp b/Source/core/dom/NodeRareData.cpp
index c29894c2a00a5f2807675c7d17679ae65a955043..9a19cec91240405b61d708da6c9e6b499b38fb5e 100644
--- a/Source/core/dom/NodeRareData.cpp
+++ b/Source/core/dom/NodeRareData.cpp
@@ -58,9 +58,20 @@ void NodeListsNodeData::invalidateCaches(const QualifiedName* attrName)
         it->value->invalidateCache();
 }
 
+#if ENABLE(OILPAN)
+void NodeListsNodeData::clearWeakMembers(Visitor* visitor)
+{
+    if (m_owner && (m_childNodeList ? 1 : 0) + m_atomicNameCaches.size() + m_tagCollectionCacheNS.size() == 0) {

[Mads Ager (chromium), 2014/05/20 06:58:57]

When we make m_owner strong again we can simplify and not check for m_owner and
not clear m_owner. We just need to check if everything became empty and clear
the Member from the owner to this object. Then this object will die in the next
GC round.

This could delay things a bit but the cleanup will happen eventually. During the
GC that makes this empty, we might get this callback before the sets have been
cleared by weak processing. That would delay the cleanup by one GC cycle. Then
we clear out the pointer from the owner to this object. This object will die in
the next round of GC, so we could delay the removal by two GCs but it will
happen in the end. :)

+        m_owner->clearNodeLists();
+        m_owner.clear();
+    }
+}
+#endif
+
 void NodeRareData::traceAfterDispatch(Visitor* visitor)
 {
     visitor->trace(m_mutationObserverData);
+    visitor->trace(m_nodeLists);
 }
 
 void NodeRareData::trace(Visitor* visitor)