Allow Oilpan heap objects account for their external allocations.

Source/core/loader/ImageLoader.cpp

Index: Source/core/loader/ImageLoader.cpp
diff --git a/Source/core/loader/ImageLoader.cpp b/Source/core/loader/ImageLoader.cpp
index a49ab8df6509ab49e7abba6dcdcdef979cb9a8fb..a245dde19a467f41a1cedfb22d48c121a1a4dd47 100644
--- a/Source/core/loader/ImageLoader.cpp
+++ b/Source/core/loader/ImageLoader.cpp
@@ -239,6 +239,7 @@ void ImageLoader::doUpdateFromElement(BypassMainWorldBehavior bypassBehavior, Up
     // We don't need to call clearLoader here: Either we were called from the
     // task, or our caller updateFromElement cleared the task's loader (and set
     // m_pendingTask to null).
+    RefPtrWillBeRawPtr<Element> protectElement(m_element.get());

[haraken, 2015/02/10 01:23:17]

What is this change for?

[sof, 2015/02/11 15:58:25]

Good question - running into stray Release crashes due to m_element->document()
being empty below. I haven't worked out why; it seems like that shouldn't be
possible.

[sof, 2015/02/12 07:28:31]

Current theory is that this is an ImageLoader element keepalive problem; the
task not keeping the loader's element alive. Trying to reproduce elsewhere.

     m_pendingTask.clear();
     // Make sure to only decrement the count when we exit this function
     OwnPtr<IncrementLoadEventDelayCount> loadDelayCounter;
@@ -251,7 +252,6 @@ void ImageLoader::doUpdateFromElement(BypassMainWorldBehavior bypassBehavior, Up
     AtomicString imageSourceURL = m_element->imageSourceURL();
     KURL url = imageSourceToKURL(imageSourceURL);
     ResourcePtr<ImageResource> newImage = 0;
-    RefPtrWillBeRawPtr<Element> protectElement(m_element.get());
     if (!url.isNull()) {
         // Unlike raw <img>, we block mixed content inside of <picture> or <img srcset>.
         ResourceLoaderOptions resourceLoaderOptions = ResourceFetcher::defaultResourceOptions();