Do not keep InvalidationSets on the Oilpan heap.

third_party/WebKit/Source/core/css/invalidation/InvalidationSet.h

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 14 matching lines @@
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef InvalidationSet_h
 #define InvalidationSet_h
 
 #include "core/CoreExport.h"
-#include "platform/heap/Handle.h"
 #include "wtf/Forward.h"
 #include "wtf/HashSet.h"
 #include "wtf/RefCounted.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/AtomicStringHash.h"
 #include "wtf/text/StringHash.h"
 
 namespace blink {
 
 class Element;
 class TracedValue;
 
 // Tracks data to determine which elements of a DOM subtree need to have style
 // recalculated.
-class CORE_EXPORT InvalidationSet final : public RefCountedWillBeGarbageCollected<InvalidationSet> {
+class CORE_EXPORT InvalidationSet final : public RefCounted<InvalidationSet> {
     WTF_MAKE_NONCOPYABLE(InvalidationSet);
 public:
-    static PassRefPtrWillBeRawPtr<InvalidationSet> create()
+    static PassRefPtr<InvalidationSet> create()
     {
-        return adoptRefWillBeNoop(new InvalidationSet);
+        return adoptRef(new InvalidationSet);
     }
 
     static void cacheTracingFlag();
 
     bool invalidatesElement(Element&) const;
 
     void combine(const InvalidationSet& other);
 
     void addClass(const AtomicString& className);
     void addId(const AtomicString& id);
@@ skipping 10 matching lines @@
     bool treeBoundaryCrossing() const { return m_treeBoundaryCrossing; }
 
     void setInsertionPointCrossing() { m_insertionPointCrossing = true; }
     bool insertionPointCrossing() const { return m_insertionPointCrossing; }
 
     void setCustomPseudoInvalid() { m_customPseudoInvalid = true; }
     bool customPseudoInvalid() const { return m_customPseudoInvalid; }
 
     bool isEmpty() const { return !m_classes && !m_ids && !m_tagNames && !m_attributes && !m_customPseudoInvalid; }
 
-    DECLARE_TRACE();
-
     void toTracedValue(TracedValue*) const;
 
 #ifndef NDEBUG
     void show() const;
 #endif
 
 private:
     InvalidationSet();
 
-    WillBeHeapHashSet<AtomicString>& ensureClassSet();
-    WillBeHeapHashSet<AtomicString>& ensureIdSet();
-    WillBeHeapHashSet<AtomicString>& ensureTagNameSet();
-    WillBeHeapHashSet<AtomicString>& ensureAttributeSet();
+    HashSet<AtomicString>& ensureClassSet();
+    HashSet<AtomicString>& ensureIdSet();
+    HashSet<AtomicString>& ensureTagNameSet();
+    HashSet<AtomicString>& ensureAttributeSet();
 
     // FIXME: optimize this if it becomes a memory issue.
-    OwnPtrWillBeMember<WillBeHeapHashSet<AtomicString>> m_classes;
-    OwnPtrWillBeMember<WillBeHeapHashSet<AtomicString>> m_ids;
-    OwnPtrWillBeMember<WillBeHeapHashSet<AtomicString>> m_tagNames;
-    OwnPtrWillBeMember<WillBeHeapHashSet<AtomicString>> m_attributes;
+    OwnPtr<HashSet<AtomicString>> m_classes;
+    OwnPtr<HashSet<AtomicString>> m_ids;
+    OwnPtr<HashSet<AtomicString>> m_tagNames;
+    OwnPtr<HashSet<AtomicString>> m_attributes;
 
     // If true, all descendants might be invalidated, so a full subtree recalc is required.
     unsigned m_allDescendantsMightBeInvalid : 1;
 
     // If true, the element itself is invalid.
     unsigned m_invalidatesSelf : 1;
 
     // If true, all descendants which are custom pseudo elements must be invalidated.
     unsigned m_customPseudoInvalid : 1;
 
     // If true, the invalidation must traverse into ShadowRoots with this set.
     unsigned m_treeBoundaryCrossing : 1;
 
     // If true, insertion point descendants must be invalidated.
     unsigned m_insertionPointCrossing : 1;
 };
 
 } // namespace blink
 
 #endif // InvalidationSet_h