Teach V8GCController how to traverse TemplateContentDocumentFragment::host

Source/bindings/v8/V8GCController.cpp

Index: Source/bindings/v8/V8GCController.cpp
diff --git a/Source/bindings/v8/V8GCController.cpp b/Source/bindings/v8/V8GCController.cpp
index 483d6480c733435afe8ee098cce49b29528bc2b1..23b00b4d20db69379835ee9e5ae93cc0230f1217 100644
--- a/Source/bindings/v8/V8GCController.cpp
+++ b/Source/bindings/v8/V8GCController.cpp
@@ -42,9 +42,11 @@
 #include "bindings/v8/WrapperTypeInfo.h"
 #include "core/dom/Attr.h"
 #include "core/dom/NodeTraversal.h"
+#include "core/dom/TemplateContentDocumentFragment.h"
 #include "core/dom/shadow/ElementShadow.h"
 #include "core/dom/shadow/ShadowRoot.h"
 #include "core/html/HTMLImageElement.h"
+#include "core/html/HTMLTemplateElement.h"
 #include "platform/TraceEvent.h"
 
 namespace WebCore {
@@ -84,7 +86,7 @@ Node* V8GCController::opaqueRootForGC(Node* node, v8::Isolate*)
         node = ownerElement;
     }
 
-    while (Node* parent = node->parentOrShadowHostNode())
+    while (Node* parent = node->parentOrShadowHostOrTemplateHostNode())
         node = parent;
 
     return node;
@@ -179,6 +181,12 @@ private:
                         return false;
                 }
             }
+            // <template> has a |content| property holding a DOM fragment which we must traverse,
+            // just like we do for the shadow trees above.
+            if (node->hasTagName(HTMLNames::templateTag)) {
+                if (!traverseTree(toHTMLTemplateElement(node)->content(), newSpaceNodes))
+                    return false;
+            }
         }
         return true;
     }
@@ -188,8 +196,8 @@ private:
         Vector<Node*, initialNodeVectorSize> newSpaceNodes;
 
         Node* node = startNode;
-        while (node->parentOrShadowHostNode())
-            node = node->parentOrShadowHostNode();
+        while (Node* parent = node->parentOrShadowHostOrTemplateHostNode())
+            node = parent;
 
         if (!traverseTree(node, &newSpaceNodes))
             return;