Oilpan: Fix a cycle caused by SVGPropertyTearOffBase::m_contextElement

For the reason described in the bug, using a Member for SVGPropertyTearOffBase::m_contextElement
causes a cycle. To break the cycle, this CL changes it to a raw pointer.
The raw pointer is safe because the context element is guaranteed to be kept alive
by a V8 wrapper of the SVG tear off object.

BUG=528275

Review URL: https://codereview.chromium.org/1330673002

git-svn-id: svn://svn.chromium.org/blink/trunk@201796 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/core/svg/properties/SVGAnimatedProperty.h

@@ -101,22 +101,9 @@ private:
     const AnimatedPropertyType m_type;
     bool m_isReadOnly;
 
-    // This reference is kept alive from V8 wrapper
-    // TODO(oilpan): This should be a Member. Currently we cannot do it because
-    // it creates a cycle as follows:
-    // SVGInterporation =(Persistent)=>
-    // SVGAnimatedProperty =(Member)=>
-    // SVGElement =(Member)=>
-    // ElementRareData =(Member)=>
-    // ElementAnimations =(part of object)=>
-    // CSSAnimations =(part of object)=>
-    // CSSAnimationUpdate =(Member)=>
-    // NewTransition =(Member)=>
-    // InertEffect =(Member)=>
-    // EffectModel =(RefPtr)=>
-    // InterpolationEffect =(RefPtr)=>
-    // InterpolationRecord =(RefPtr)=>
-    // SVGInterpolation
+    // This raw pointer is safe since the SVG element is guaranteed to be kept
+    // alive by a V8 wrapper.
+    GC_PLUGIN_IGNORE("crbug.com/528275")
     SVGElement* m_contextElement;
 
     const QualifiedName& m_attributeName;

third_party/WebKit/Source/core/svg/properties/SVGPropertyTearOff.h

@@ -98,7 +98,6 @@ public:
 
     DEFINE_INLINE_VIRTUAL_TRACE()
     {
-        visitor->trace(m_contextElement);
     }
 
 protected:
@@ -111,8 +110,10 @@ protected:
     }
 
 private:
-    // These references are kept alive from V8 wrapper to prevent reference cycles
-    RawPtrWillBeMember<SVGElement> m_contextElement;
+    // This raw pointer is safe since the SVG element is guaranteed to be kept
+    // alive by a V8 wrapper.
+    GC_PLUGIN_IGNORE("crbug.com/528275")
+    SVGElement* m_contextElement;
 
     PropertyIsAnimValType m_propertyIsAnimVal;
     bool m_isReadOnlyProperty;