Oilpan: HeapVectorBacking should call destructors for its elements

Source/wtf/Vector.h

 /*
  *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
  *  License as published by the Free Software Foundation; either
  *  version 2 of the License, or (at your option) any later version.
  *
  *  This library is distributed in the hope that it will be useful,
  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 1008 matching lines @@
         // The check is just a static hint for a compiler to indicate that
         // Base::expandBuffer returns false if Allocator is a DefaultAllocator.
         if (Allocator::isGarbageCollected && Base::expandBuffer(newCapacity)) {
             ANNOTATE_CHANGE_CAPACITY(begin(), oldCapacity, m_size, capacity());
             return;
         }
         T* oldEnd = end();
         Base::allocateExpandedBuffer(newCapacity);
         ANNOTATE_NEW_BUFFER(begin(), capacity(), m_size);
         TypeOperations::move(oldBuffer, oldEnd, begin());
+        clearUnusedSlots(oldBuffer, oldEnd);
         ANNOTATE_DELETE_BUFFER(oldBuffer, oldCapacity, m_size);
         Base::deallocateBuffer(oldBuffer);
     }
 
     template<typename T, size_t inlineCapacity, typename Allocator>
     inline void Vector<T, inlineCapacity, Allocator>::reserveInitialCapacity(size_t initialCapacity)
     {
         ASSERT(!m_size);
         ASSERT(capacity() == INLINE_CAPACITY);
         if (initialCapacity > INLINE_CAPACITY) {
@@ skipping 20 matching lines @@
             if (Base::shrinkBuffer(newCapacity)) {
                 ANNOTATE_CHANGE_CAPACITY(begin(), oldCapacity, m_size, capacity());
                 return;
             }
 
             T* oldEnd = end();
             Base::allocateBuffer(newCapacity);
             if (begin() != oldBuffer) {
                 ANNOTATE_NEW_BUFFER(begin(), capacity(), m_size);
                 TypeOperations::move(oldBuffer, oldEnd, begin());
+                clearUnusedSlots(oldBuffer, oldEnd);
                 ANNOTATE_DELETE_BUFFER(oldBuffer, oldCapacity, m_size);
             }
         } else {
             Base::resetBufferPointer();
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
             if (oldBuffer != begin()) {
                 ANNOTATE_NEW_BUFFER(begin(), capacity(), m_size);
                 ANNOTATE_DELETE_BUFFER(oldBuffer, oldCapacity, m_size);
             }
 #endif
@@ skipping 199 matching lines @@
     // This is only called if the allocator is a HeapAllocator. It is used when
     // visiting during a tracing GC.
     template<typename T, size_t inlineCapacity, typename Allocator>
     template<typename VisitorDispatcher>
     void Vector<T, inlineCapacity, Allocator>::trace(VisitorDispatcher visitor)
     {
         ASSERT(Allocator::isGarbageCollected); // Garbage collector must be enabled.
         const T* bufferBegin = buffer();
         const T* bufferEnd = buffer() + size();
         if (ShouldBeTraced<VectorTraits<T>>::value) {
             for (const T* bufferEntry = bufferBegin; bufferEntry != bufferEnd; bufferEntry++)

[haraken, 2015/04/18 23:48:47]

Here would it be helpful to insert ASSERTs to verify that the elements between
[size(), capacity()] are correctly cleared out?

[sof, 2015/04/19 20:10:52]

Excellent suggestion. Added & by doing so I came across two places where buffer
slots ought to have been cleared, but were not: for swap() and resize().

I've added clearing to both of them here; if it is preferred to have this be
split up some, I can do that.

Notice that the failure to clear upon resize() is behind what crbug.com/469111
runs into. 

                 Allocator::template trace<VisitorDispatcher, T, VectorTraits<T>>(visitor, *const_cast<T*>(bufferEntry));
         }
         if (this->hasOutOfLineBuffer())
             Allocator::markNoTracing(visitor, buffer());
     }
 
 #if !ENABLE(OILPAN)
     template<typename T, size_t N>
     struct NeedsTracing<Vector<T, N>> {
         static const bool value = false;
     };
 #endif
 
 } // namespace WTF
 
 using WTF::Vector;
 
 #endif // WTF_Vector_h