Oilpan: pull SVGPropertyBase off the heap.

Source/core/svg/properties/SVGProperty.h

Index: Source/core/svg/properties/SVGProperty.h
diff --git a/Source/core/svg/properties/SVGProperty.h b/Source/core/svg/properties/SVGProperty.h
index 8e162e72214675b1513aafb78802b85b791b42bb..6a4236f5f7eeef6405f1c8c7d7fc7467e8e6b9e2 100644
--- a/Source/core/svg/properties/SVGProperty.h
+++ b/Source/core/svg/properties/SVGProperty.h
@@ -43,7 +43,7 @@ namespace blink {
 class SVGElement;
 class SVGAnimationElement;
 
-class SVGPropertyBase : public RefCountedWillBeRefCountedGarbageCollected<SVGPropertyBase> {
+class SVGPropertyBase : public RefCounted<SVGPropertyBase> {
     WTF_MAKE_NONCOPYABLE(SVGPropertyBase);
 
 public:
@@ -84,36 +84,17 @@ public:
         m_ownerList = ownerList;
     }
 
-    virtual void trace(Visitor* visitor)
-    {
-        visitor->trace(m_ownerList);
-    }
-
 protected:
     explicit SVGPropertyBase(AnimatedPropertyType type)
         : m_type(type)
         , m_ownerList(nullptr)
     {
-#if ENABLE(OILPAN)
-        // FIXME: Oilpan: the objects that derive from this RefCountedGarbageCollected<>
-        // base object are all RefPtr<T>-exposed (i.e., create()s returning a PassRefPtr<T>.)
-        //
-        // Following r183582, RefCountedGarbageCollected<>::m_refCount is initialized
-        // as 0, which is safe assuming the constructor result is initially handled/returned
-        // as a raw pointer. But to support an "RefCounted-identical" view of such a fresh
-        // object, we need to adjust the RefCountedGarbageCollected<>::m_refCount to be
-        // its assumed 1 for these derived objects to function as expected.
-        //
-        // This would be simpler if the derived SVG property objects created GCed objects
-        // proper. Remove this ref count adjustment when this happens.
-        ref();
-#endif
     }
 
 private:
     const AnimatedPropertyType m_type;
 
-    RawPtrWillBeMember<SVGPropertyBase> m_ownerList;
+    SVGPropertyBase* m_ownerList;
 };
 
 }