Oilpan: Disable lazy seeping for ImageLoaders

Source/core/loader/ImageLoader.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 44 matching lines @@
 class ImageLoader;
 class LayoutImageResource;
 
 template<typename T> class EventSender;
 typedef EventSender<ImageLoader> ImageEventSender;
 
 class CORE_EXPORT ImageLoader : public NoBaseWillBeGarbageCollectedFinalized<ImageLoader>, public ImageResourceClient {
 public:
     explicit ImageLoader(Element*);
     virtual ~ImageLoader();
+
+    // We must run the destructor in the eager sweeping phase and call
+    // m_image->removeClient(this). Otherwise, the ImageResource can invoke
+    // didAddClient() for the ImageLoader that is about to die in the current
+    // lazy sweeping, and the didAddClient() can access on-heap objects that
+    // have already been finalized in the current lazy sweeping.
+    EAGERLY_FINALIZE();
     DECLARE_TRACE();
 
     enum UpdateFromElementBehavior {
         // This should be the update behavior when the element is attached to a document, or when DOM mutations trigger a new load.
         // Starts loading if a load hasn't already been started.
         UpdateNormal,
         // This should be the update behavior when the resource was changed (via 'src', 'srcset' or 'sizes').
         // Starts a new load even if a previous load of the same resource have failed, to match Firefox's behavior.
         // FIXME - Verify that this is the right behavior according to the spec.
         UpdateIgnorePreviousError,
@@ skipping 110 matching lines @@
     bool m_imageComplete : 1;
     bool m_loadingImageDocument : 1;
     bool m_elementIsProtected : 1;
     bool m_suppressErrorEvents : 1;
     unsigned m_highPriorityClientCount;
 };
 
 }
 
 #endif