Oilpan: Make sure that vtables for garbage collected mixin objects have

Source/platform/heap/HeapTest.cpp

Index: Source/platform/heap/HeapTest.cpp
diff --git a/Source/platform/heap/HeapTest.cpp b/Source/platform/heap/HeapTest.cpp
index 2a859aa7fe07fa6acae5ccea4c175cb7a54d29a8..2057fb15fbe51076dcf4805bdd4f9c43386b6611 100644
--- a/Source/platform/heap/HeapTest.cpp
+++ b/Source/platform/heap/HeapTest.cpp
@@ -4841,4 +4841,44 @@ TEST(HeapTest, ObjectDeadBit)
     DeadBitTester::test();
 }
 
+class MixinWithGarbageCollectionInConstructor : public GarbageCollectedMixin {
+public:
+    MixinWithGarbageCollectionInConstructor()
+    {
+        Heap::collectGarbage(ThreadState::HeapPointersOnStack);
+    }
+};
+
+class ClassWithGarbageCollectingMixinConstructor
+    : public GarbageCollected<ClassWithGarbageCollectingMixinConstructor>
+    , public MixinWithGarbageCollectionInConstructor {
+    USING_GARBAGE_COLLECTED_MIXIN(ClassWithGarbageCollectingMixinConstructor);
+public:
+    ClassWithGarbageCollectingMixinConstructor() : m_wrapper(IntWrapper::create(32))
+    {
+    }
+
+    virtual void trace(Visitor* visitor)
+    {
+        visitor->trace(m_wrapper);
+    }
+
+    void verify()
+    {
+        EXPECT_EQ(32, m_wrapper->value());
+    }
+
+private:
+    Member<IntWrapper> m_wrapper;
+};
+
+// Regression test for out of bounds call through vtable.
+// Passes if it doesn't crash.
+TEST(HeapTest, GarbageCollectionDuringMixinConstruction)
+{
+    ClassWithGarbageCollectingMixinConstructor* a =
+        new ClassWithGarbageCollectingMixinConstructor();
+    a->verify();
+}
+
 } // WebCore namespace