analyze function calls in Traverse/Unlink

[amccreight]

It is not uncommon for a class to factor out common code between its Unlink and destructor into a function, then invoke that function in both places. We should be able to analyze fields unlinked in subcalls in this manner.

To properly handle this situation, we need to track the set of functions that are called in Traverse/Unlink, analyze these functions, then add the fields the calls touch to the set of fields touched by the Traverse/Unlink function. Doing this will probably require doing delayed analysis, as the subroutine could potentially be defined before or after the Traverse/Unlink.

Examples:

• NotificationController's Unlink (in accessible/src/base/NotificationController.cpp) invokes Shutdown() to unlink many things
• nsDOMAttributeMap's Unlink (in content/base/src) invokes DropReference() to unlink mAttributeCache.
• nsRange's Unlink (in content/base/src)
• nsInProcessTabChildGlobal's Traverse