Oilpan: fix tracing of un-initialized part objects during conservative GCs.

Source/platform/heap/Visitor.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 271 matching lines @@
     // to trace through a part object with visitor->trace(m_partObject). This
     // takes a const argument, because otherwise it will match too eagerly: a
     // non-const argument would match a non-const Vector<T>& argument better
     // than the specialization that takes const Vector<T>&. For a similar reason,
     // the other specializations take a const argument even though they are
     // usually used with non-const arguments, otherwise this function would match
     // too well.
     template<typename T>
     void trace(const T& t)
     {
+        if (WTF::IsPolymorphic<T>::value) {
+            intptr_t vtable = *reinterpret_cast<const intptr_t*>(&t);
+            if (!vtable)
+                return;
+        }
         const_cast<T&>(t).trace(this);
     }
 
     // The following trace methods are for off-heap collections.
     template<typename T, size_t inlineCapacity>
     void trace(const Vector<T, inlineCapacity>& vector)
     {
         OffHeapCollectionTraceTrait<Vector<T, inlineCapacity, WTF::DefaultAllocator> >::trace(this, vector);
     }
 
@@ skipping 20 matching lines @@
     // objects have vtables we have to have the callback as an
     // explicit argument, but we can use the templated one-argument
     // mark method above to automatically provide the callback
     // function.
     virtual void mark(const void*, TraceCallback) = 0;
     virtual void markNoTracing(const void* pointer) { mark(pointer, reinterpret_cast<TraceCallback>(0)); }
 
     // Used to mark objects during conservative scanning.
     virtual void mark(HeapObjectHeader*, TraceCallback) = 0;
     virtual void mark(FinalizedHeapObjectHeader*, TraceCallback) = 0;
-    virtual void markConservatively(HeapObjectHeader*) = 0;
-    virtual void markConservatively(FinalizedHeapObjectHeader*) = 0;
 
     // If the object calls this during the regular trace callback, then the
     // WeakPointerCallback argument may be called later, when the strong roots
     // have all been found. The WeakPointerCallback will normally use isAlive
     // to find out whether some pointers are pointing to dying objects. When
     // the WeakPointerCallback is done the object must have purged all pointers
     // to objects where isAlive returned false. In the weak callback it is not
     // allowed to touch other objects (except using isAlive) or to allocate on
     // the GC heap. Note that even removing things from HeapHashSet or
     // HeapHashMap can cause an allocation if the backing store resizes, but
@@ skipping 297 matching lines @@
 struct GCInfoTrait {
     static const GCInfo* get()
     {
         return GCInfoAtBase<typename GetGarbageCollectedBase<T>::type>::get();
     }
 };
 
 }
 
 #endif