Oilpan: move SVG property hierarchy to the heap.

Source/core/svg/SVGPathSeg.h

Index: Source/core/svg/SVGPathSeg.h
diff --git a/Source/core/svg/SVGPathSeg.h b/Source/core/svg/SVGPathSeg.h
index 55964dc489c2872782f76edcf7a26e9bdd3bccf9..bdb76ebdbc2e6848620bb254dd349a2525135bb8 100644
--- a/Source/core/svg/SVGPathSeg.h
+++ b/Source/core/svg/SVGPathSeg.h
@@ -22,6 +22,7 @@
 #define SVGPathSeg_h
 
 #include "bindings/core/v8/ScriptWrappable.h"
+#include "platform/heap/Handle.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
@@ -62,7 +63,7 @@ class SVGPropertyBase;
 class SVGPathElement;
 class SVGElement;
 
-class SVGPathSeg : public RefCounted<SVGPathSeg>, public ScriptWrappable {
+class SVGPathSeg : public RefCountedWillBeGarbageCollectedFinalized<SVGPathSeg>, public ScriptWrappable {
     DEFINE_WRAPPERTYPEINFO();
 public:
     // SVGPathSeg itself is used as a tear-off type.
@@ -118,16 +119,17 @@ public:
         m_contextElement = contextElement;

[haraken, 2014/11/11 05:22:46]

Ditto.

[sof, 2014/11/12 13:45:08]

Same, never called to clear out m_contextElement.

     }
 
-    static PassRefPtr<SVGPathSeg> create() { ASSERT_NOT_REACHED(); return nullptr; }
-    PassRefPtr<SVGPathSeg> clone() { ASSERT_NOT_REACHED(); return nullptr; }
+    static PassRefPtrWillBeRawPtr<SVGPathSeg> create() { ASSERT_NOT_REACHED(); return nullptr; }
+    PassRefPtrWillBeRawPtr<SVGPathSeg> clone() { ASSERT_NOT_REACHED(); return nullptr; }
+
+    virtual void trace(Visitor*);
 
 protected:
     void commitChange();
 
 private:
-    // FIXME: oilpan: These are kept as raw ptrs to break reference cycle. Should be Member in oilpan.
-    SVGPropertyBase* m_ownerList;
-    SVGElement* m_contextElement;
+    RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
+    RawPtrWillBeMember<SVGElement> m_contextElement;
 };
 
 } // namespace blink