Oilpan: fix ref counting of derived SVG property objects.

Source/core/svg/properties/SVGProperty.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 76 matching lines @@
     virtual void trace(Visitor* visitor)
     {
         visitor->trace(m_ownerList);
     }
 
 protected:
     explicit SVGPropertyBase(AnimatedPropertyType type)
         : m_type(type)
         , m_ownerList(nullptr)
     {
+#if ENABLE(OILPAN)
+        // FIXME: Oilpan: the objects that derive from this RefCountedGarbageCollected<>
+        // base object are all RefPtr<T>-exposed (i.e., create()s returning a PassRefPtr<T>.)
+        //
+        // Following r183582, RefCountedGarbageCollected<>::m_refCount is initialized
+        // as 0, which is safe assuming the constructor result is initially handled/returned
+        // as a raw pointer. But to support an "RefCounted-identical" view of such a fresh
+        // object, we need to adjust the RefCountedGarbageCollected<>::m_refCount to be
+        // its assumed 1 for these derived objects to function as expected.
+        //
+        // This would be simpler if the derived SVG property objects created GCed objects
+        // proper. Remove this ref count adjustment when this happens.
+        ref();
+#endif
     }
 
 private:
     const AnimatedPropertyType m_type;
 
     RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
 };
 
 }
 
 #endif // SVGProperty_h