Fix CFI errors in Oilpan

third_party/WebKit/Source/platform/heap/HeapAllocator.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef HeapAllocator_h
 #define HeapAllocator_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/Persistent.h"
 #include "platform/heap/TraceTraits.h"
@@ skipping 288 matching lines @@
   // Use the payload size as recorded by the heap to determine how many
   // elements to finalize.
   size_t length = header->payloadSize() / sizeof(T);
   T* buffer = reinterpret_cast<T*>(pointer);
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
   // As commented above, HeapVectorBacking calls finalizers for unused slots
   // (which are already zeroed out).
   ANNOTATE_CHANGE_SIZE(buffer, length, 0, length);
 #endif
   if (std::is_polymorphic<T>::value) {
+    char* pointer = reinterpret_cast<char*>(buffer);
     for (unsigned i = 0; i < length; ++i) {
-      if (blink::vTableInitialized(&buffer[i]))
-        buffer[i].~T();
+      char* element = pointer + i * sizeof(T);
+      if (blink::vTableInitialized(element))
+        reinterpret_cast<T*>(element)->~T();
     }
   } else {
     for (unsigned i = 0; i < length; ++i) {
       buffer[i].~T();
     }
   }
 }
 
 template <typename Table>
 void HeapHashTableBacking<Table>::finalize(void* pointer) {
@@ skipping 447 matching lines @@
     const blink::HeapHashCountedSet<Value, HashFunctions, Traits>& set,
     VectorType& vector) {
   copyToVector(static_cast<const HashCountedSet<Value, HashFunctions, Traits,
                                                 blink::HeapAllocator>&>(set),
                vector);
 }
 
 }  // namespace WTF
 
 #endif