Do not keep InvalidationSets on the Oilpan heap.

third_party/WebKit/Source/core/css/RuleFeature.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  * Library General Public License for more details.
  *
  * You should have received a copy of the GNU Library General Public License
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  *
  */
 
 #ifndef RuleFeature_h
 #define RuleFeature_h
 
 #include "core/CoreExport.h"
 #include "core/css/CSSSelector.h"
 #include "core/css/invalidation/InvalidationSet.h"
+#include "platform/heap/Handle.h"
 #include "wtf/Forward.h"
 #include "wtf/HashSet.h"
 #include "wtf/text/AtomicStringHash.h"
 
 namespace blink {
 
 class QualifiedName;
 class RuleData;
 class SpaceSplitString;
 class StyleRule;
 
 struct RuleFeature {
     ALLOW_ONLY_INLINE_ALLOCATION();
 public:
     RuleFeature(StyleRule*, unsigned selectorIndex, bool hasDocumentSecurityOrigin);
 
     DECLARE_TRACE();
 
     RawPtrWillBeMember<StyleRule> rule;
     unsigned selectorIndex;
     bool hasDocumentSecurityOrigin;
 };
 
-using InvalidationSetVector = WillBeHeapVector<RefPtrWillBeMember<InvalidationSet>, 8>;
+using InvalidationSetVector = WillBeHeapVector<RefPtr<InvalidationSet>, 8>;
 
 class CORE_EXPORT RuleFeatureSet {
     DISALLOW_ALLOCATION();
 public:
     RuleFeatureSet();
     ~RuleFeatureSet();
 
     void add(const RuleFeatureSet&);
     void clear();
 
@@ skipping 32 matching lines @@
 
     DECLARE_TRACE();
 
     WillBeHeapVector<RuleFeature> siblingRules;
     WillBeHeapVector<RuleFeature> uncommonAttributeRules;
 
 protected:
     InvalidationSet* invalidationSetForSelector(const CSSSelector&);
 
 private:
-    using InvalidationSetMap = WillBeHeapHashMap<AtomicString, RefPtrWillBeMember<InvalidationSet>>;
-    using PseudoTypeInvalidationSetMap = WillBeHeapHashMap<CSSSelector::PseudoType, RefPtrWillBeMember<InvalidationSet>, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>;
+    using InvalidationSetMap = HashMap<AtomicString, RefPtr<InvalidationSet>>;
+    using PseudoTypeInvalidationSetMap = HashMap<CSSSelector::PseudoType, RefPtr<InvalidationSet>, WTF::IntHash<unsigned>, WTF::UnsignedWithZeroKeyHashTraits<unsigned>>;
 
     struct FeatureMetadata {
         DISALLOW_ALLOCATION();
         FeatureMetadata()
             : usesFirstLineRules(false)
             , usesWindowInactiveSelector(false)
             , foundSiblingSelector(false)
             , maxDirectAdjacentSelectors(0)
         { }
         void add(const FeatureMetadata& other);
@@ skipping 56 matching lines @@
     InvalidationSetMap m_attributeInvalidationSets;
     InvalidationSetMap m_idInvalidationSets;
     PseudoTypeInvalidationSetMap m_pseudoInvalidationSets;
 };
 
 } // namespace blink
 
 WTF_ALLOW_MOVE_AND_INIT_WITH_MEM_FUNCTIONS(blink::RuleFeature);
 
 #endif // RuleFeature_h