Oilpan: move ImageBitmap to the oilpan heap.

Source/core/loader/ImageLoader.h

Index: Source/core/loader/ImageLoader.h
diff --git a/Source/core/loader/ImageLoader.h b/Source/core/loader/ImageLoader.h
index ad0deb677452442c09fb8c2f6e9af4b712971c06..aa9de30f2c13a991f0315e2f18b462253b2478c4 100644
--- a/Source/core/loader/ImageLoader.h
+++ b/Source/core/loader/ImageLoader.h
@@ -26,18 +26,21 @@
 #include "core/fetch/ImageResource.h"
 #include "core/fetch/ImageResourceClient.h"
 #include "core/fetch/ResourcePtr.h"
+#include "heap/Handle.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/AtomicString.h"
 
 namespace WebCore {
 
-class ImageLoaderClient {
+class ImageLoaderClient : public WillBeGarbageCollectedMixin {
 public:
     virtual void notifyImageSourceChanged() = 0;
 
     // Determines whether the observed ImageResource should have higher priority in the decoded resources cache.
     virtual bool requestsHighLiveResourceCachePriority() { return false; }
 
+    virtual void trace(Visitor*) = 0;
+
 protected:
     ImageLoaderClient() { }
 };
@@ -106,9 +109,11 @@ private:
 
     void timerFired(Timer<ImageLoader>*);
 
+    typedef WillBePersistentHeapHashSet<RawPtrWillBeWeakMember<ImageLoaderClient> > ImageLoaderClientSet;

[haraken, 2014/03/13 01:22:28]

Can't you use WillBeHeapHashSet<RawPtrWillBeWeakMember<ImageLoaderClient>> and
trace it? Given that ImageLoaderClient is a GarbageCollectedMixin, you can have
on-heap objects in ImageLoaderClient.

[sof, 2014/03/13 06:14:37]

At some point, hopefully. This is in ImageLoader (the diff is misleading), which
isn't a garbage collected object.

+
     Element* m_element;
     ResourcePtr<ImageResource> m_image;
-    HashSet<ImageLoaderClient*> m_clients;
+    ImageLoaderClientSet m_clients;
     Timer<ImageLoader> m_derefElementTimer;
     AtomicString m_failedLoadURL;
     bool m_hasPendingBeforeLoadEvent : 1;