Oilpan: move RenderObjects off heap.

Source/core/rendering/RenderTextFragment.h

Index: Source/core/rendering/RenderTextFragment.h
diff --git a/Source/core/rendering/RenderTextFragment.h b/Source/core/rendering/RenderTextFragment.h
index 3cd396faacd45d8ad271db6a8c4040cab3c4aa2e..cd2bb0543e38c8a8731c04abd976765b9e455d77 100644
--- a/Source/core/rendering/RenderTextFragment.h
+++ b/Source/core/rendering/RenderTextFragment.h
@@ -38,7 +38,6 @@ public:
     RenderTextFragment(Node*, StringImpl*, int startOffset, int length);
     RenderTextFragment(Node*, StringImpl*);
     virtual ~RenderTextFragment();
-    virtual void trace(Visitor*) override;
     virtual void destroy() override;
 
     virtual bool isTextFragment() const override { return true; }
@@ -83,7 +82,8 @@ private:
     unsigned m_end;
     bool m_isRemainingTextRenderer;
     RefPtr<StringImpl> m_contentString;
-    RawPtrWillBeMember<FirstLetterPseudoElement> m_firstLetterPseudoElement;
+    // Oilpan: weak reference back to GCed owner; its lifetime subsumes this object.

[haraken, 2015/02/04 05:48:56]

I'm not sure of this comment. Even if RenderObject is on-heap, I guess
m_firstLetterPseudoElement should be a strong reference (i.e., Member).

[sof, 2015/02/04 08:44:32]

It was a Member<> when RenderObject was on heap, and cannot be now. It is
cleared on FirstLetterPseudoElement::detach().

Updated the comment wording.

+    FirstLetterPseudoElement* m_firstLetterPseudoElement;
 };
 
 DEFINE_TYPE_CASTS(RenderTextFragment, RenderObject, object, toRenderText(object)->isTextFragment(), toRenderText(object).isTextFragment());