Trace ScriptWrappableVisitor.m_markingDeque by oilpan gc

third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h

Index: third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h b/third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h
index 7d6a6b28294800f4ff24f8f9aea9e7316cc25287..1d891941912438776b5662c86a7988759a184aa6 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h
+++ b/third_party/WebKit/Source/bindings/core/v8/ScriptWrappableVisitor.h
@@ -8,6 +8,7 @@
 #include "bindings/core/v8/ScopedPersistent.h"
 #include "bindings/core/v8/ScriptWrappable.h"
 #include "core/CoreExport.h"
+#include "platform/RuntimeEnabledFeatures.h"
 #include "platform/heap/WrapperVisitor.h"
 #include "wtf/Deque.h"
 #include "wtf/Vector.h"
@@ -33,6 +34,11 @@ public:
     ScriptWrappableVisitor(v8::Isolate* isolate) : m_isolate(isolate) {};
     ~ScriptWrappableVisitor() override;
     /**
+     * Replace all dead objects in the marking deque with nullptr after oilpan
+     * gc.
+     */
+    static void invalidateDeadObjectsInMarkingDeque(v8::Isolate*);
+    /**
      * Mark wrappers in all worlds for the given script wrappable as alive in
      * V8.
      */
@@ -48,6 +54,7 @@ public:
 
     void TracePrologue() override;
     void RegisterV8References(const std::vector<std::pair<void*, void*>>& internalFieldsOfPotentialWrappers) override;
+    void RegisterV8Reference(const std::pair<void*, void*>& internalFields);
     bool AdvanceTracing(double deadlineInMs, v8::EmbedderHeapTracer::AdvanceTracingActions) override;
     void TraceEpilogue() override;
 
@@ -68,14 +75,16 @@ public:
 
     void traceWrappers(const ScopedPersistent<v8::Value>*) const override;
 
+    void invalidateDeadObjectsInMarkingDeque();
+
 private:
     bool markWrapperHeader(HeapObjectHeader*) const;
     bool markWrapperHeader(const ScriptWrappable*) const override;
     bool markWrapperHeader(const void* garbageCollected) const override;
     bool m_tracingInProgress = false;
     /**
-     * Collection of ScriptWrappables we need to trace from. We assume it safe
-     * to hold on to the raw pointers because:
+     * Collection of ScriptWrappables we need to trace from. We assume it is
+     * safe to hold on to the raw pointers because:
      *     * oilpan object cannot move
      *     * for the oilpan gc, this deque is part of the root set, so objects
      *       in the deque will not die