Oilpan: fix tracing of un-initialized part objects during conservative GCs.

Source/platform/heap/Visitor.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 271 matching lines @@
     // to trace through a part object with visitor->trace(m_partObject). This
     // takes a const argument, because otherwise it will match too eagerly: a
     // non-const argument would match a non-const Vector<T>& argument better
     // than the specialization that takes const Vector<T>&. For a similar reason,
     // the other specializations take a const argument even though they are
     // usually used with non-const arguments, otherwise this function would match
     // too well.
     template<typename T>
     void trace(const T& t)
     {
+        if (WTF::IsPolymorphic<T>::value) {
+            intptr_t vtable = *reinterpret_cast<const intptr_t*>(&t);
+            if (!vtable)

[haraken, 2014/08/11 10:44:02]

Can we merge this check with vTableInitialized() in Heap.cpp?

(I thought that the vTableInitialized() check in
HeapPage<Header>::checkAndMarkPointer was enough.)

[Mads Ager (chromium), 2014/08/11 12:17:36]

These are two different checks:

The check that we already have is for the case where an argument to a
constructor allocates. In that case we can see a pointer on the stack that
points to a garbage collected object that should have a virtual table but it has
not yet been initialized.

The check that I'm adding here is for part objects that have virtual methods but
where the vtable is not yet initialized because the construction of the part
object hasn't started yet.

We are performing conservative scanning of the object reachable from the stack.
We shouldn't have to (when Ian has updated the plugin to make sure that the
first word is actually a vtable). I'll remove the conservative scanning on the
stack so that we just ignore the object in both cases (and maybe add asserts
that the object pointed to on the stack is completely uninitialized).

+                return;
+        }
         const_cast<T&>(t).trace(this);
     }
 
     // The following trace methods are for off-heap collections.
     template<typename T, size_t inlineCapacity>
     void trace(const Vector<T, inlineCapacity>& vector)
     {
         OffHeapCollectionTraceTrait<Vector<T, inlineCapacity, WTF::DefaultAllocator> >::trace(this, vector);
     }
 
@@ skipping 332 matching lines @@
 struct GCInfoTrait {
     static const GCInfo* get()
     {
         return GCInfoAtBase<typename GetGarbageCollectedBase<T>::type>::get();
     }
 };
 
 }
 
 #endif