Disallow off-heap containers containing raw on-heap pointers.

third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp

Index: third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
index 49fc73f111fdcfbcefb2640737c197d7aac7915b..43f68e76a7a9c208757cece115bd6a484018c162 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.cpp
@@ -559,8 +559,9 @@ void SourceListDirective::addSourceHash(
   m_hashAlgorithmsUsed |= algorithm;
 }
 
-void SourceListDirective::addSourceToMap(HashMap<String, CSPSource*>& hashMap,
-                                         CSPSource* source) {
+void SourceListDirective::addSourceToMap(
+    HeapHashMap<String, Member<CSPSource>>& hashMap,
+    CSPSource* source) {
   hashMap.add(source->getScheme(), source);
   if (source->getScheme() == "http")
     hashMap.add("https", source);
@@ -642,16 +643,17 @@ bool SourceListDirective::subsumes(
   return CSPSource::firstSubsumesSecond(normalizedA, normalizedB);
 }
 
-HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
+HeapHashMap<String, Member<CSPSource>>
+SourceListDirective::getIntersectSchemesOnly(
     HeapVector<Member<CSPSource>> other) {
-  HashMap<String, CSPSource*> schemesA;
+  HeapHashMap<String, Member<CSPSource>> schemesA;
   for (const auto& sourceA : m_list) {
     if (sourceA->isSchemeOnly())
       addSourceToMap(schemesA, sourceA);
   }
   // Add schemes only sources if they are present in both `this` and `other`,
   // allowing upgrading `http` to `https` and `ws` to `wss`.
-  HashMap<String, CSPSource*> intersect;
+  HeapHashMap<String, Member<CSPSource>> intersect;
   for (const auto& sourceB : other) {
     if (sourceB->isSchemeOnly()) {
       if (schemesA.contains(sourceB->getScheme()))
@@ -668,14 +670,14 @@ HashMap<String, CSPSource*> SourceListDirective::getIntersectSchemesOnly(
 
 HeapVector<Member<CSPSource>> SourceListDirective::getIntersectCSPSources(
     HeapVector<Member<CSPSource>> other) {
-  HashMap<String, CSPSource*> schemesMap = getIntersectSchemesOnly(other);
+  auto schemesMap = getIntersectSchemesOnly(other);
   HeapVector<Member<CSPSource>> normalized;
   // Add all normalized scheme source expressions.
-  for (auto it = schemesMap.begin(); it != schemesMap.end(); ++it) {
+  for (const auto& it : schemesMap) {
     // We do not add secure versions if insecure schemes are present.
-    if ((it->key != "https" || !schemesMap.contains("http")) &&
-        (it->key != "wss" || !schemesMap.contains("ws"))) {
-      normalized.append(it->value);
+    if ((it.key != "https" || !schemesMap.contains("http")) &&
+        (it.key != "wss" || !schemesMap.contains("ws"))) {
+      normalized.append(it.value);
     }
   }