[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/core/css/StylePropertySet.cpp

 /*
  * (C) 1999-2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2012, 2013 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Research In Motion Limited. All rights reserved.
  * Copyright (C) 2013 Intel Corporation. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 24 matching lines @@
 
 #ifndef NDEBUG
 #include "wtf/text/CString.h"
 #include <stdio.h>
 #endif
 
 namespace blink {
 
 static size_t sizeForImmutableStylePropertySetWithPropertyCount(unsigned count)
 {
-    return sizeof(ImmutableStylePropertySet) - sizeof(void*) + sizeof(CSSValue*) * count + sizeof(StylePropertyMetadata) * count;
+    return sizeof(ImmutableStylePropertySet) - sizeof(void*) + sizeof(RawPtrWillBeMember<CSSValue>) * count + sizeof(StylePropertyMetadata) * count;

[haraken, 2015/11/10 16:37:05]

Let's land this change separately.

[peria, 2015/11/11 02:46:34]

Done.
https://codereview.chromium.org/1433843002/

 }
 
 PassRefPtrWillBeRawPtr<ImmutableStylePropertySet> ImmutableStylePropertySet::create(const CSSProperty* properties, unsigned count, CSSParserMode cssParserMode)
 {
     ASSERT(count <= MaxArraySize);
 #if ENABLE(OILPAN)
     void* slot = Heap::allocate<StylePropertySet>(sizeForImmutableStylePropertySetWithPropertyCount(count));
 #else
     void* slot = WTF::Partitions::fastMalloc(sizeForImmutableStylePropertySetWithPropertyCount(count));
 #endif // ENABLE(OILPAN)
@@ skipping 456 matching lines @@
 {
     return adoptRefWillBeNoop(new MutableStylePropertySet(cssParserMode));
 }
 
 PassRefPtrWillBeRawPtr<MutableStylePropertySet> MutableStylePropertySet::create(const CSSProperty* properties, unsigned count)
 {
     return adoptRefWillBeNoop(new MutableStylePropertySet(properties, count));
 }
 
 } // namespace blink