Oilpan: move RenderObjects off heap.

Source/core/rendering/RenderTextFragment.h

 /*
  * (C) 1999 Lars Knoll (knoll@kde.org)
  * (C) 2000 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 20 matching lines @@
 
 // Used to represent a text substring of an element, e.g., for text runs that are split because of
 // first letter and that must therefore have different styles (and positions in the render tree).
 // We cache offsets so that text transformations can be applied in such a way that we can recover
 // the original unaltered string from our corresponding DOM node.
 class RenderTextFragment final : public RenderText {
 public:
     RenderTextFragment(Node*, StringImpl*, int startOffset, int length);
     RenderTextFragment(Node*, StringImpl*);
     virtual ~RenderTextFragment();
-    virtual void trace(Visitor*) override;
     virtual void destroy() override;
 
     virtual bool isTextFragment() const override { return true; }
 
     virtual bool canBeSelectionLeaf() const override { return node() && node()->hasEditableStyle(); }
 
     unsigned start() const { return m_start; }
     unsigned end() const { return m_end; }
 
     virtual unsigned textStartOffset() const override { return start(); }
@@ skipping 24 matching lines @@
 private:
     RenderBlock* blockForAccompanyingFirstLetter() const;
     virtual UChar previousCharacter() const override;
 
     Text* associatedTextNode() const;
 
     unsigned m_start;
     unsigned m_end;
     bool m_isRemainingTextRenderer;
     RefPtr<StringImpl> m_contentString;
-    RawPtrWillBeMember<FirstLetterPseudoElement> m_firstLetterPseudoElement;
+    // Oilpan: weak reference back to GCed owner; its lifetime subsumes this object.

[haraken, 2015/02/04 05:48:56]

I'm not sure of this comment. Even if RenderObject is on-heap, I guess
m_firstLetterPseudoElement should be a strong reference (i.e., Member).

[sof, 2015/02/04 08:44:32]

It was a Member<> when RenderObject was on heap, and cannot be now. It is
cleared on FirstLetterPseudoElement::detach().

Updated the comment wording.

+    FirstLetterPseudoElement* m_firstLetterPseudoElement;
 };
 
 DEFINE_TYPE_CASTS(RenderTextFragment, RenderObject, object, toRenderText(object)->isTextFragment(), toRenderText(object).isTextFragment());
 
 } // namespace blink
 
 #endif // RenderTextFragment_h