heap: Trace Vector buffer up to capacity

Tracing to capacity means we don't need to check size_ during
tracing anymore.

Bug: 986235
Change-Id: Idae046fcbb6a1705c1522d56479d560091415ea4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2107983Reviewed-by: Kentaro Hara <haraken@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#751353}

third_party/blink/renderer/platform/wtf/vector.h

@@ -628,7 +628,10 @@ class VectorBuffer : protected VectorBufferBase<T, Allocator> {
  public:
   using OffsetRange = typename Base::OffsetRange;
 
-  VectorBuffer() : Base(InlineBuffer(), inlineCapacity) {}
+  VectorBuffer() : Base(InlineBuffer(), inlineCapacity) {
+    // Make sure the inline buffer is clear.
+    Base::ClearUnusedSlots(InlineBuffer(), InlineBuffer() + inlineCapacity);
+  }
 
   VectorBuffer(HashTableDeletedValueType value) : Base(value) {}
   bool IsHashTableDeletedValue() const {
@@ -637,6 +640,8 @@ class VectorBuffer : protected VectorBufferBase<T, Allocator> {
 
   explicit VectorBuffer(wtf_size_t capacity)
       : Base(InlineBuffer(), inlineCapacity) {
+    // Make sure the inline buffer is clear.
+    Base::ClearUnusedSlots(InlineBuffer(), InlineBuffer() + inlineCapacity);
     if (capacity > inlineCapacity)
       Base::AllocateBuffer(capacity);
   }
@@ -2064,7 +2069,7 @@ Vector<T, inlineCapacity, Allocator>::Trace(VisitorDispatcher visitor) const {
       return;
     // Inline buffer requires tracing immediately.
     const T* buffer_begin = buffer;
-    const T* buffer_end = buffer + size();
+    const T* buffer_end = buffer + inlineCapacity;
     if (IsTraceableInCollectionTrait<VectorTraits<T>>::value) {
       for (const T* buffer_entry = buffer_begin; buffer_entry != buffer_end;
            buffer_entry++) {