JSSVGDynamicPODTypeWrapper inherits from RefCounted (via JSSVGPODTypeWrapper), but RefCounted will not call its virtual destructor. So, data members of JSSVGDynamicPODTypeWrapper will not be destructed in the normal course of RefCounted lifetime. I think the original issue is that JSSVGPODTypeWrapper should not have inherited from RefCounted, and then someone fell into the trap of actually doing meaningful work in the destructor.
@Alexey - Is this applicable anymore? I couldn't find any references to this in our code base? It seems this commit removed it - https://github.com/WebKit/WebKit/commit/4d739154052f4dda48b5cd06e09c0d896955c568