Oilpan: Fix weak processing for IntersectionObserver::m_root

third_party/WebKit/Source/platform/heap/Heap.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 99 matching lines @@
     template<typename T>
     static inline bool isHeapObjectAlive(const UntracedMember<T>& member)
     {
         return isHeapObjectAlive(member.get());
     }
     template<typename T>
     static inline bool isHeapObjectAlive(const RawPtr<T>& ptr)
     {
         return isHeapObjectAlive(ptr.get());
     }
+    template<typename T>
+    static inline bool isHeapObjectAlive(const WeakPtr<T>& ptr)

[sof, 2016/01/16 14:26:12]

Do we really want this?

+    {
+        return isHeapObjectAlive(ptr.get());
+    }
 
     // Is the finalizable GC object still alive, but slated for lazy sweeping?
     // If a lazy sweep is in progress, returns true if the object was found
     // to be not reachable during the marking phase, but it has yet to be swept
     // and finalized. The predicate returns false in all other cases.
     //
     // Holding a reference to an already-dead object is not a valid state
     // to be in; willObjectBeLazilySwept() has undefined behavior if passed
     // such a reference.
     template<typename T>
@@ skipping 358 matching lines @@
 void VisitorHelper<Derived>::handleWeakCell(Visitor* self, void* object)
 {
     T** cell = reinterpret_cast<T**>(object);
     if (*cell && !ObjectAliveTrait<T>::isHeapObjectAlive(*cell))
         *cell = nullptr;
 }
 
 } // namespace blink
 
 #endif // Heap_h