Oilpan: pull SVGPropertyBase off the heap.

Source/core/svg/properties/SVGProperty.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 25 matching lines @@
 #include "wtf/Noncopyable.h"
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 #include "wtf/text/WTFString.h"
 
 namespace blink {
 
 class SVGElement;
 class SVGAnimationElement;
 
-class SVGPropertyBase : public RefCountedWillBeRefCountedGarbageCollected<SVGPropertyBase> {
+class SVGPropertyBase : public RefCounted<SVGPropertyBase> {
     WTF_MAKE_NONCOPYABLE(SVGPropertyBase);
 
 public:
     // Properties do not have a primitive type by default
     typedef void PrimitiveType;
 
     virtual ~SVGPropertyBase()
     {
         ASSERT(!m_ownerList);
     }
@@ skipping 20 matching lines @@
     }
 
     void setOwnerList(SVGPropertyBase* ownerList)
     {
         // Previous owner list must be cleared before setting new owner list.
         ASSERT((!ownerList && m_ownerList) || (ownerList && !m_ownerList));
 
         m_ownerList = ownerList;
     }
 
-    virtual void trace(Visitor* visitor)
-    {
-        visitor->trace(m_ownerList);
-    }
-
 protected:
     explicit SVGPropertyBase(AnimatedPropertyType type)
         : m_type(type)
         , m_ownerList(nullptr)
     {
-#if ENABLE(OILPAN)
-        // FIXME: Oilpan: the objects that derive from this RefCountedGarbageCollected<>
-        // base object are all RefPtr<T>-exposed (i.e., create()s returning a PassRefPtr<T>.)
-        //
-        // Following r183582, RefCountedGarbageCollected<>::m_refCount is initialized
-        // as 0, which is safe assuming the constructor result is initially handled/returned
-        // as a raw pointer. But to support an "RefCounted-identical" view of such a fresh
-        // object, we need to adjust the RefCountedGarbageCollected<>::m_refCount to be
-        // its assumed 1 for these derived objects to function as expected.
-        //
-        // This would be simpler if the derived SVG property objects created GCed objects
-        // proper. Remove this ref count adjustment when this happens.
-        ref();
-#endif
     }
 
 private:
     const AnimatedPropertyType m_type;
 
-    RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
+    SVGPropertyBase* m_ownerList;
 };
 
 }
 
 #endif // SVGProperty_h