Oilpan: add missing tracing of Attr objects.

Oilpan: add missing tracing of Attr objects.

The Attr's element needs to be accounted for when tracing.

R=haraken@chromium.org
BUG=357163
Committed: https://src.chromium.org/viewvc/blink?view=rev&revision=174720

[sof, 2014-05-23 15:34:43]

Please take a look.

Crash reproducible with --enable-leak-detection &
fast/dom/Attr/child-nodes-cache.html

[haraken, 2014-05-23 15:55:25]

LGTM.

Ian: Would it be possible to add a check to the plugin to verify that GCObject*
is not used in other objects? Until we move the Node hierarchy to the heap, we
can disable the verification for the Node hierarchy. I'm a bit concerned that we
might ship some modules leaving some raw pointers in other objects (e.g.,
IDBRequest* in some other object).

[sof, 2014-05-23 15:58:44]

The CQ bit was checked by sigbjornf@opera.com

[commit-bot: I haz the power, 2014-05-23 15:59:15]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/sigbjornf@opera.com/293113008/1

[commit-bot: I haz the power, 2014-05-23 17:21:02]

FYI, CQ is re-trying this CL (attempt #1).
Please consider checking whether the failures are real,
and report flakes to chrome-troopers@google.com.
The failing builders are:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/8928)

[commit-bot: I haz the power, 2014-05-23 18:45:10]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2014-05-23 18:45:11]

Try jobs failed on following builders:
  win_blink_rel on tryserver.blink
(http://build.chromium.org/p/tryserver.blink/builders/win_blink_rel/builds/8944)

[sof, 2014-05-23 21:22:58]

The CQ bit was checked by sigbjornf@opera.com

[commit-bot: I haz the power, 2014-05-23 21:23:43]

CQ is trying da patch. Follow status at
 https://chromium-status.appspot.com/cq/sigbjornf@opera.com/293113008/1

[commit-bot: I haz the power, 2014-05-23 22:19:01]

Change committed as 174720

[Mads Ager (chromium), 2014-05-26 09:45:37]

On 2014/05/23 15:55:25, haraken wrote:
> LGTM.
> 
> Ian: Would it be possible to add a check to the plugin to verify that
GCObject*
> is not used in other objects? Until we move the Node hierarchy to the heap, we
> can disable the verification for the Node hierarchy. I'm a bit concerned that
we
> might ship some modules leaving some raw pointers in other objects (e.g.,
> IDBRequest* in some other object).

Ian should confirm, but I'm pretty sure that the current rule in the plugin is
that you cannot have raw pointers to objects that are shipping with oilpan but
(because we have to allow it in the transition period) you can have raw pointers
to objects that are only WillBeGarbageCollected and not on by default.

[zerny-chromium, 2014-05-26 09:51:16]

On 2014/05/26 09:45:37, Mads Ager (chromium) wrote:
> On 2014/05/23 15:55:25, haraken wrote:
> > LGTM.
> > 
> > Ian: Would it be possible to add a check to the plugin to verify that
> GCObject*
> > is not used in other objects? Until we move the Node hierarchy to the heap,
we
> > can disable the verification for the Node hierarchy. I'm a bit concerned
that
> we
> > might ship some modules leaving some raw pointers in other objects (e.g.,
> > IDBRequest* in some other object).
> 
> Ian should confirm, but I'm pretty sure that the current rule in the plugin is
> that you cannot have raw pointers to objects that are shipping with oilpan but
> (because we have to allow it in the transition period) you can have raw
pointers
> to objects that are only WillBeGarbageCollected and not on by default.

That is right. When compiling with oilpan enabled, we do not require that raw
pointers be traced members. Doing so would force us to do very large changes or
to sprinkle GC_PLUGIN_IGNORE annotations everywhere. This check (along with
checks that we do not have RefPtr to GC allocated objects) is enabled when
running with oilpan disabled (ie, for fully enabled types we will make these
checks).