Allow Oilpan heap objects account for their external allocations.

Source/core/loader/ImageLoader.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
@@ skipping 221 matching lines @@
 void ImageLoader::doUpdateFromElement(BypassMainWorldBehavior bypassBehavior, UpdateFromElementBehavior updateBehavior)
 {
     // FIXME: According to
     // http://www.whatwg.org/specs/web-apps/current-work/multipage/embedded-content.html#the-img-element:the-img-element-55
     // When "update image" is called due to environment changes and the load fails, onerror should not be called.
     // That is currently not the case.
     //
     // We don't need to call clearLoader here: Either we were called from the
     // task, or our caller updateFromElement cleared the task's loader (and set
     // m_pendingTask to null).
+    RefPtrWillBeRawPtr<Element> protectElement(m_element.get());

[haraken, 2015/02/10 01:23:17]

What is this change for?

[sof, 2015/02/11 15:58:25]

Good question - running into stray Release crashes due to m_element->document()
being empty below. I haven't worked out why; it seems like that shouldn't be
possible.

[sof, 2015/02/12 07:28:31]

Current theory is that this is an ImageLoader element keepalive problem; the
task not keeping the loader's element alive. Trying to reproduce elsewhere.

     m_pendingTask.clear();
     // Make sure to only decrement the count when we exit this function
     OwnPtr<IncrementLoadEventDelayCount> loadDelayCounter;
     loadDelayCounter.swap(m_loadDelayCounter);
 
     Document& document = m_element->document();
     if (!document.isActive())
         return;
 
     AtomicString imageSourceURL = m_element->imageSourceURL();
     KURL url = imageSourceToKURL(imageSourceURL);
     ResourcePtr<ImageResource> newImage = 0;
-    RefPtrWillBeRawPtr<Element> protectElement(m_element.get());
     if (!url.isNull()) {
         // Unlike raw <img>, we block mixed content inside of <picture> or <img srcset>.
         ResourceLoaderOptions resourceLoaderOptions = ResourceFetcher::defaultResourceOptions();
         ResourceRequest resourceRequest(url);
         resourceRequest.setFetchCredentialsMode(WebURLRequest::FetchCredentialsModeSameOrigin);
         if (isHTMLPictureElement(element()->parentNode()) || !element()->fastGetAttribute(HTMLNames::srcsetAttr).isNull()) {
             resourceLoaderOptions.mixedContentBlockingTreatment = TreatAsActiveContent;
             resourceRequest.setRequestContext(WebURLRequest::RequestContextImageSet);
         }
         FetchRequest request(resourceRequest, element()->localName(), resourceLoaderOptions);
@@ skipping 324 matching lines @@
 #endif
 }
 
 #if ENABLE(OILPAN)
 ImageLoader::ImageLoaderClientRemover::~ImageLoaderClientRemover()
 {
     m_loader.willRemoveClient(m_client);
 }
 #endif
 }