Move MediaQuery classes off BlinkGC heap

third_party/WebKit/Source/core/css/MediaQueryList.h

Index: third_party/WebKit/Source/core/css/MediaQueryList.h
diff --git a/third_party/WebKit/Source/core/css/MediaQueryList.h b/third_party/WebKit/Source/core/css/MediaQueryList.h
index c67b3400656e6d97764495a809e50a5ae5357bf4..519ac8da98859b8048c79de86c503b66157517ae 100644
--- a/third_party/WebKit/Source/core/css/MediaQueryList.h
+++ b/third_party/WebKit/Source/core/css/MediaQueryList.h
@@ -52,7 +52,7 @@ class CORE_EXPORT MediaQueryList final
  public:
   static MediaQueryList* Create(ExecutionContext*,
                                 MediaQueryMatcher*,
-                                MediaQuerySet*);
+                                PassRefPtr<MediaQuerySet>);
   ~MediaQueryList() override;
 
   String media() const;
@@ -86,12 +86,14 @@ class CORE_EXPORT MediaQueryList final
   ExecutionContext* GetExecutionContext() const override;
 
  private:
-  MediaQueryList(ExecutionContext*, MediaQueryMatcher*, MediaQuerySet*);
+  MediaQueryList(ExecutionContext*,
+                 MediaQueryMatcher*,
+                 PassRefPtr<MediaQuerySet>);
 
   bool UpdateMatches();
 
   Member<MediaQueryMatcher> matcher_;
-  Member<MediaQuerySet> media_;
+  RefPtr<MediaQuerySet> media_;
   using ListenerList = HeapListHashSet<Member<MediaQueryListListener>>;
   ListenerList listeners_;
   bool matches_dirty_;