Oilpan: move SVG property hierarchy to the heap.

Source/core/svg/SVGPolyElement.h

Index: Source/core/svg/SVGPolyElement.h
diff --git a/Source/core/svg/SVGPolyElement.h b/Source/core/svg/SVGPolyElement.h
index ec9c971ee528ee6687728db27d1ba55611aaa98b..b580717d84af363e0a14fb8a810fdead4e2da841 100644
--- a/Source/core/svg/SVGPolyElement.h
+++ b/Source/core/svg/SVGPolyElement.h
@@ -25,6 +25,7 @@
 #include "core/svg/SVGAnimatedBoolean.h"
 #include "core/svg/SVGAnimatedPointList.h"
 #include "core/svg/SVGGeometryElement.h"
+#include "platform/heap/Handle.h"
 
 namespace blink {
 
@@ -32,8 +33,10 @@ class SVGPolyElement : public SVGGeometryElement {
 public:
     SVGAnimatedPointList* points() { return m_points.get(); }
 
-    PassRefPtr<SVGPointListTearOff> pointsFromJavascript() { return m_points->baseVal(); }
-    PassRefPtr<SVGPointListTearOff> animatedPoints() { return m_points->animVal(); }
+    PassRefPtrWillBeRawPtr<SVGPointListTearOff> pointsFromJavascript() { return m_points->baseVal(); }
+    PassRefPtrWillBeRawPtr<SVGPointListTearOff> animatedPoints() { return m_points->animVal(); }
+
+    virtual void trace(Visitor*) override;
 
 protected:
     SVGPolyElement(const QualifiedName&, Document&);
@@ -43,7 +46,7 @@ private:
     virtual void svgAttributeChanged(const QualifiedName&) override final;
 
 private:
-    RefPtr<SVGAnimatedPointList> m_points;
+    RefPtrWillBeMember<SVGAnimatedPointList> m_points;
 
 };