heap: Prohibit Vector::Fill for on-heap vectors.

Vector::Fill uses std::fill, which I believe is not safe for concurrent
marking. Currently there are no usages of Vector::Fill for on-heap
vectors.

Disabling Vector::Fill for on-heap vectors will give a compile time
error if anyone tries to use it. I think we can avoid introducing an
atomic version of Vector::Fill and revisit it if and when such a usage
is wanted.

Bug: 986235
Change-Id: I7ac1cb95be3456d86e75f39e0aaf27120e388a84
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2106057
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Cr-Commit-Position: refs/heads/master@{#751340}

third_party/blink/renderer/platform/wtf/vector.h

@@ -1299,8 +1299,15 @@ class Vector
   // or copy-initialize all the elements.
   //
   // Fill(value) is a synonym for Fill(value, size()).
-  void Fill(const T&, wtf_size_t);
-  void Fill(const T& val) { Fill(val, size()); }
+  //
+  // The implementation of Fill uses std::fill which is not yet supported for
+  // garbage collected vectors.
+  template <typename A = Allocator>
+  std::enable_if_t<!A::kIsGarbageCollected> Fill(const T&, wtf_size_t);
+  template <typename A = Allocator>
+  std::enable_if_t<!A::kIsGarbageCollected> Fill(const T& val) {
+    Fill(val, size());
+  }
 
   // Swap two vectors quickly.
   void swap(Vector& other) {
@@ -1594,8 +1601,9 @@ wtf_size_t Vector<T, inlineCapacity, Allocator>::ReverseFind(
 }
 
 template <typename T, wtf_size_t inlineCapacity, typename Allocator>
-void Vector<T, inlineCapacity, Allocator>::Fill(const T& val,
-                                                wtf_size_t new_size) {
+template <typename A>
+std::enable_if_t<!A::kIsGarbageCollected>
+Vector<T, inlineCapacity, Allocator>::Fill(const T& val, wtf_size_t new_size) {
   if (size() > new_size) {
     Shrink(new_size);
   } else if (new_size > capacity()) {