Fix CFI errors in Oilpan

third_party/WebKit/Source/platform/heap/TraceTraits.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef TraceTraits_h
 #define TraceTraits_h
 
 #include "platform/heap/GCInfo.h"
 #include "platform/heap/Heap.h"
 #include "platform/heap/InlinedGlobalMarkingVisitor.h"
@@ skipping 473 matching lines @@
     DCHECK(IsTraceableInCollectionTrait<Traits>::value);
 
     T* array = reinterpret_cast<T*>(self);
     blink::HeapObjectHeader* header =
         blink::HeapObjectHeader::fromPayload(self);
     ASSERT(header->checkHeader());
     // Use the payload size as recorded by the heap to determine how many
     // elements to trace.
     size_t length = header->payloadSize() / sizeof(T);
     if (std::is_polymorphic<T>::value) {
-      for (size_t i = 0; i < length; ++i) {
-        if (blink::vTableInitialized(&array[i]))
+      char* pointer = reinterpret_cast<char*>(array);
+      for (unsigned i = 0; i < length; ++i) {
+        char* element = pointer + i * sizeof(T);
+        if (blink::vTableInitialized(element))
           blink::TraceIfEnabled<
               T, IsTraceableInCollectionTrait<Traits>::value>::trace(visitor,
                                                                      array[i]);
       }
     } else {
 #ifdef ANNOTATE_CONTIGUOUS_CONTAINER
       // As commented above, HeapVectorBacking can trace unused slots
       // (which are already zeroed out).
       ANNOTATE_CHANGE_SIZE(array, length, 0, length);
 #endif
@@ skipping 250 matching lines @@
     // since iterating over the hash table backing will find the whole
     // chain.
     visitor->markNoTracing(node);
     return false;
   }
 };
 
 }  // namespace WTF
 
 #endif