Oilpan: Clear unused slots in Deque so they are not found in conservative GCs

If we find a direct pointer to the backing store of the deque (this will
normally be an iterator) we have to trace the backing without knowing how
much of it is in use (that information is in the Deque itself, not the
backing store).  This means we have to ensure that unused areas of the
backing store are zeroed out.
R=ager@chromium.org, mikhail.pozdnyakov@untel.com
BUG=

Review URL: https://codereview.chromium.org/308323002

git-svn-id: svn://svn.chromium.org/blink/trunk@175277 bbb929c8-8fbe-4397-9dbb-9b2b20218538

third_party/WebKit/Source/wtf/Deque.h

@@ -246,11 +246,14 @@ namespace WTF {
     template<typename T, size_t inlineCapacity, typename Allocator>
     inline void Deque<T, inlineCapacity, Allocator>::destroyAll()
     {
-        if (m_start <= m_end)
+        if (m_start <= m_end) {
             TypeOperations::destruct(m_buffer.buffer() + m_start, m_buffer.buffer() + m_end);
-        else {
+            m_buffer.clearUnusedSlots(m_buffer.buffer() + m_start, m_buffer.buffer() + m_end);
+        } else {
             TypeOperations::destruct(m_buffer.buffer(), m_buffer.buffer() + m_end);
+            m_buffer.clearUnusedSlots(m_buffer.buffer(), m_buffer.buffer() + m_end);
             TypeOperations::destruct(m_buffer.buffer() + m_start, m_buffer.buffer() + m_buffer.capacity());
+            m_buffer.clearUnusedSlots(m_buffer.buffer() + m_start, m_buffer.buffer() + m_buffer.capacity());
         }
     }
 
@@ -375,6 +378,7 @@ namespace WTF {
     {
         ASSERT(!isEmpty());
         TypeOperations::destruct(&m_buffer.buffer()[m_start], &m_buffer.buffer()[m_start + 1]);
+        m_buffer.clearUnusedSlots(&m_buffer.buffer()[m_start], &m_buffer.buffer()[m_start + 1]);
         if (m_start == m_buffer.capacity() - 1)
             m_start = 0;
         else
@@ -390,6 +394,7 @@ namespace WTF {
         else
             --m_end;
         TypeOperations::destruct(&m_buffer.buffer()[m_end], &m_buffer.buffer()[m_end + 1]);
+        m_buffer.clearUnusedSlots(&m_buffer.buffer()[m_end], &m_buffer.buffer()[m_end + 1]);
     }
 
     template<typename T, size_t inlineCapacity, typename Allocator>
@@ -416,9 +421,11 @@ namespace WTF {
         // Find which segment of the circular buffer contained the remove element, and only move elements in that part.
         if (position >= m_start) {
             TypeOperations::moveOverlapping(buffer + m_start, buffer + position, buffer + m_start + 1);
+            m_buffer.clearUnusedSlots(buffer + m_start, buffer + m_start + 1);
             m_start = (m_start + 1) % m_buffer.capacity();
         } else {
             TypeOperations::moveOverlapping(buffer + position + 1, buffer + m_end, buffer + position);
+            m_buffer.clearUnusedSlots(buffer + m_end - 1, buffer + m_end);
             m_end = (m_end - 1 + m_buffer.capacity()) % m_buffer.capacity();
         }
     }

third_party/WebKit/Source/wtf/Vector.h

@@ -43,6 +43,9 @@ static const size_t kInitialVectorSize = 1;
 static const size_t kInitialVectorSize = WTF_VECTOR_INITIAL_SIZE;
 #endif
 
+    template<typename T, size_t inlineBuffer, typename Allocator>
+    class Deque;
+
     template <bool needsDestruction, typename T>
     struct VectorDestructor;
 
@@ -494,6 +497,8 @@ static const size_t kInitialVectorSize = WTF_VECTOR_INITIAL_SIZE;
         const T* inlineBuffer() const { return reinterpret_cast_ptr<const T*>(m_inlineBuffer.buffer); }
 
         AlignedBuffer<m_inlineBufferSize, WTF_ALIGN_OF(T)> m_inlineBuffer;
+        template<typename U, size_t inlineBuffer, typename V>
+        friend class Deque;
     };
 
     template<typename T, size_t inlineCapacity, typename Allocator>