unified-heap: Integrate in snapshots

With unified heap TraceWrapperMember is deprecated and we need an alternative
way to produce heap snapshots in the case (a) we are interested in JS objects,
and (b) in the case we are interested in the full unified object graph.

This patch provides a new way to generate the snapshot for V8 embedders and
performs the following operations:
- Objects are classified as attached, detached, or unknown.
- Depending an implicit mode, objects are classified as relevant or internal.
  This classification happens based on NameTrait and the fact that all
  ScriptWrappable objects (those that can have JS properties) are using that
  trait.
- Not relevant objects are filtered where possible, e.g., sub graphs of
  internals are filtered and not reported.

The algorithm performs a single pass on the graph, starting from V8-to-Blink
references that identify attached nodes. Each object then starts a recursion
into its own subgraph to identify and filter subgraphs that only consist of
internals. Roots, which are potentially Blink only, are transitively
traversed after handling JavaScript related objects.

Change-Id: I746930e0ede6b18d6942d9bfcef4950f13aea967
Bug: 936797
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1499567
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#638105}
2 files changed