Oilpan: add transition types to track interface objects.

Source/core/html/HTMLTrackElement.cpp

Index: Source/core/html/HTMLTrackElement.cpp
diff --git a/Source/core/html/HTMLTrackElement.cpp b/Source/core/html/HTMLTrackElement.cpp
index 7dfe53d4a82b68a0450f2c6d1616ec327a1e643d..650a7c181a264224027f8a41f4bca1bd0b73b15b 100644
--- a/Source/core/html/HTMLTrackElement.cpp
+++ b/Source/core/html/HTMLTrackElement.cpp
@@ -60,8 +60,6 @@ inline HTMLTrackElement::HTMLTrackElement(Document& document)
 
 HTMLTrackElement::~HTMLTrackElement()
 {
-    if (m_track)

[Mads Ager (chromium), 2014/04/22 13:07:15]

We should probably be careful and wrap this in #if !ENABLE(OILPAN) instead of
just deleting it?

[sof, 2014/04/22 14:02:48]

I don't mind putting it back in (even if I risk getting complaints of redundant
#ifs :) ), but like for HTMLMediaElement & TextTrackList, the element will not
be used. HTMLTrackElement created the track object & it will be destructed just
afterwards in the non-Oilpan case.

[Mads Ager (chromium), 2014/04/22 14:17:59]

What if it has a JavaScript wrapper which also keeps it alive and can interact
with it? Use-after-free? We need to be very careful when removing pointer
clearing in the non-oilpan build. Some of them can probably be removed but it is
very dangerous.

-        m_track->clearTrackElement();
 }
 
 PassRefPtr<HTMLTrackElement> HTMLTrackElement::create(Document& document)
@@ -272,4 +270,10 @@ HTMLMediaElement* HTMLTrackElement::mediaElement() const
     return 0;
 }
 
+void HTMLTrackElement::trace(Visitor* visitor)
+{
+    visitor->trace(m_track);
+    HTMLElement::trace(visitor);
+}
+
 }