Oilpan: move SVG property hierarchy to the heap.

Source/core/svg/properties/SVGProperty.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 25 matching lines @@
 #include "wtf/Noncopyable.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class SVGElement;
 class SVGAnimationElement;
 
-class SVGPropertyBase : public RefCounted<SVGPropertyBase> {
+class SVGPropertyBase : public RefCountedWillBeGarbageCollectedFinalized<SVGPropertyBase> {
     WTF_MAKE_NONCOPYABLE(SVGPropertyBase);
 
 public:
     // Properties do not have a primitive type by default
     typedef void PrimitiveType;
 
     virtual ~SVGPropertyBase()
     {
+#if !ENABLE(OILPAN)
+        // Oilpan: a property can legitimately be swept out along with its list,
+        // hence this cannot be made to hold.
         ASSERT(!m_ownerList);
+#endif
     }
 
     // FIXME: remove this in WebAnimations transition.
     // This is used from SVGAnimatedNewPropertyAnimator for its animate-by-string implementation.
-    virtual PassRefPtr<SVGPropertyBase> cloneForAnimation(const String&) const = 0;
+    virtual PassRefPtrWillBeRawPtr<SVGPropertyBase> cloneForAnimation(const String&) const = 0;
 
     virtual String valueAsString() const = 0;
 
     // FIXME: remove below and just have this inherit AnimatableValue in WebAnimations transition.
     virtual void add(PassRefPtrWillBeRawPtr<SVGPropertyBase>, SVGElement*) = 0;
-    virtual void calculateAnimatedValue(SVGAnimationElement*, float percentage, unsigned repeatCount, PassRefPtr<SVGPropertyBase> from, PassRefPtr<SVGPropertyBase> to, PassRefPtr<SVGPropertyBase> toAtEndOfDurationValue, SVGElement*) = 0;
-    virtual float calculateDistance(PassRefPtr<SVGPropertyBase> to, SVGElement*) = 0;
+    virtual void calculateAnimatedValue(SVGAnimationElement*, float percentage, unsigned repeatCount, PassRefPtrWillBeRawPtr<SVGPropertyBase> from, PassRefPtrWillBeRawPtr<SVGPropertyBase> to, PassRefPtrWillBeRawPtr<SVGPropertyBase> toAtEndOfDurationValue, SVGElement*) = 0;
+    virtual float calculateDistance(PassRefPtrWillBeRawPtr<SVGPropertyBase> to, SVGElement*) = 0;
 
     AnimatedPropertyType type()
     {
         return m_type;
     }
 
     SVGPropertyBase* ownerList() const
     {
         return m_ownerList;
     }
 
     void setOwnerList(SVGPropertyBase* ownerList)

[haraken, 2014/11/11 05:22:46]

Just to confirm: Isn't it possible that setOwnerList(0) is called in some
destructors?

[sof, 2014/11/12 13:45:08]

It doesn't currently happen. We can't statically catch anyone adding such a call
from a SVGProperty list implementation in the future, but I would expect ASAN
and tests to pick up on that pretty quickly.

     {
         // Previous owner list must be cleared before setting new owner list.
         ASSERT((!ownerList && m_ownerList) || (ownerList && !m_ownerList));
 
         m_ownerList = ownerList;
     }
 
+    virtual void trace(Visitor* visitor)
+    {
+        visitor->trace(m_ownerList);
+    }
+
 protected:
     explicit SVGPropertyBase(AnimatedPropertyType type)
         : m_type(type)
         , m_ownerList(nullptr)
     {
     }
 
 private:
     const AnimatedPropertyType m_type;
 
-    SVGPropertyBase* m_ownerList;
+    RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
 };
 
 }
 
 #endif // SVGProperty_h