[oilpan] Explicitly trace out-of-line vector backings

- Avoid tracing elements directly from WTF::Vector and WTF::Deque
  when the backing store is allocated out-of-line.
- Avoid MarkNoTrace optimization breaking the tracing/marking
  abstraction.

Bug: chromium:802273
Change-Id: Icfb5deed3479d4a7dec85c82930b464bdfe16b0e
Reviewed-on: https://chromium-review.googlesource.com/886484
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#532806}

third_party/WebKit/Source/platform/bindings/TraceWrapperMember.h

@@ -89,13 +89,21 @@ void swap(HeapVector<TraceWrapperMember<T>>& a,
   }
 }
 
+// HeapVectorBacking<TraceWrapperMember<T>> need to map to
+// HeapVectorBacking<Member<T>> for performing the swap method below.
+template <typename T, typename Traits>
+struct GCInfoTrait<HeapVectorBacking<TraceWrapperMember<T>, Traits>>
+    : public GCInfoTrait<
+          HeapVectorBacking<Member<T>, WTF::VectorTraits<Member<T>>>> {};
+
 // Swaps two HeapVectors, one containing TraceWrapperMember and one with
 // regular Members. The custom swap function is required as TraceWrapperMember
 // potentially requires emitting a write barrier.
 template <typename T>
 void swap(HeapVector<TraceWrapperMember<T>>& a, HeapVector<Member<T>>& b) {
   // HeapVector<Member<T>> and HeapVector<TraceWrapperMember<T>> have the
-  // same size and semantics.
+  // same size and semantics. This cast and swap assumes that GCInfo for both
+  // TraceWrapperMember and Member match in vector backings.
   HeapVector<Member<T>>& a_ = reinterpret_cast<HeapVector<Member<T>>&>(a);
   a_.swap(b);
   if (ThreadState::Current()->WrapperTracingInProgress()) {

third_party/WebKit/Source/platform/heap/HeapAllocator.h

@@ -279,6 +279,16 @@ class PLATFORM_EXPORT HeapAllocator {
 #endif  // BUILDFLAG(BLINK_HEAP_INCREMENTAL_MARKING)
   }
 
+  template <typename T, typename VisitorDispatcher>
+  static void TraceVectorBacking(VisitorDispatcher visitor,
+                                 T* backing,
+                                 T** backing_slot) {
+    HeapVectorBacking<T>* vector_backing =
+        reinterpret_cast<HeapVectorBacking<T>*>(backing);
+    visitor->RegisterBackingStoreReference(backing_slot);
+    visitor->Trace(vector_backing);
+  }
+
  private:
   static void BackingFree(void*);
   static bool BackingExpand(void*, size_t);

third_party/WebKit/Source/platform/wtf/Deque.h

@@ -676,29 +676,33 @@ std::enable_if_t<A::kIsGarbageCollected>
 Deque<T, inlineCapacity, Allocator>::Trace(VisitorDispatcher visitor) {
   static_assert(Allocator::kIsGarbageCollected,
                 "Garbage collector must be enabled.");
-  const T* buffer_begin = buffer_.Buffer();
-  const T* end = buffer_begin + end_;
-  if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
-    if (start_ <= end_) {
-      for (const T* buffer_entry = buffer_begin + start_; buffer_entry != end;
-           buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-    } else {
-      for (const T* buffer_entry = buffer_begin; buffer_entry != end;
-           buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-      const T* buffer_end = buffer_.Buffer() + buffer_.capacity();
-      for (const T* buffer_entry = buffer_begin + start_;
-           buffer_entry != buffer_end; buffer_entry++)
-        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-            visitor, *const_cast<T*>(buffer_entry));
-    }
-  }
   if (buffer_.HasOutOfLineBuffer()) {
-    Allocator::MarkNoTracing(visitor, buffer_.Buffer());
-    Allocator::RegisterBackingStoreReference(visitor, buffer_.BufferSlot());
+    Allocator::TraceVectorBacking(visitor, buffer_.Buffer(),
+                                  buffer_.BufferSlot());
+  } else {
+    const T* buffer_begin = buffer_.Buffer();
+    const T* end = buffer_begin + end_;
+    if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
+      if (start_ <= end_) {
+        for (const T* buffer_entry = buffer_begin + start_; buffer_entry != end;
+             buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+      } else {
+        for (const T* buffer_entry = buffer_begin; buffer_entry != end;
+             buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+        const T* buffer_end = buffer_.Buffer() + buffer_.capacity();
+        for (const T* buffer_entry = buffer_begin + start_;
+             buffer_entry != buffer_end; buffer_entry++) {
+          Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+              visitor, *const_cast<T*>(buffer_entry));
+        }
+      }
+    }
   }
 }
 

third_party/WebKit/Source/platform/wtf/Vector.h

@@ -1959,8 +1959,7 @@ inline bool operator!=(const Vector<T, inlineCapacityA, Allocator>& a,
   return !(a == b);
 }
 
-// This is only defined if the allocator is a HeapAllocator. It is used when
-// visiting during a tracing GC.
+// Only defined for HeapAllocator. Used when visiting vector object.
 template <typename T, size_t inlineCapacity, typename Allocator>
 template <typename VisitorDispatcher, typename A>
 std::enable_if_t<A::kIsGarbageCollected>
@@ -1970,23 +1969,19 @@ Vector<T, inlineCapacity, Allocator>::Trace(VisitorDispatcher visitor) {
   if (!Buffer())
     return;
   if (this->HasOutOfLineBuffer()) {
-    // This is a performance optimization for a case where the buffer has
-    // been already traced by somewhere. This can happen if the conservative
-    // scanning traced an on-stack (false-positive or real) pointer to the
-    // HeapVector, and then visitor->trace() traces the HeapVector.
-    if (Allocator::IsHeapObjectAlive(Buffer()))
-      return;
-    Allocator::MarkNoTracing(visitor, Buffer());
-    Allocator::RegisterBackingStoreReference(visitor, Base::BufferSlot());
-  }
-  const T* buffer_begin = Buffer();
-  const T* buffer_end = Buffer() + size();
-  if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
-    for (const T* buffer_entry = buffer_begin; buffer_entry != buffer_end;
-         buffer_entry++)
-      Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
-          visitor, *const_cast<T*>(buffer_entry));
-    CheckUnusedSlots(Buffer() + size(), Buffer() + capacity());
+    Allocator::TraceVectorBacking(visitor, Buffer(), Base::BufferSlot());
+  } else {
+    // Inline buffer requires tracing immediately.
+    const T* buffer_begin = Buffer();
+    const T* buffer_end = Buffer() + size();
+    if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
+      for (const T* buffer_entry = buffer_begin; buffer_entry != buffer_end;
+           buffer_entry++) {
+        Allocator::template Trace<VisitorDispatcher, T, VectorTraits<T>>(
+            visitor, *const_cast<T*>(buffer_entry));
+      }
+      CheckUnusedSlots(Buffer() + size(), Buffer() + capacity());
+    }
   }
 }