Disallow off-heap containers containing raw on-heap pointers.

third_party/WebKit/Source/core/frame/csp/SourceListDirective.h

Index: third_party/WebKit/Source/core/frame/csp/SourceListDirective.h
diff --git a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.h b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.h
index fb105657160a316640a5cf8fe6d8b7daaa4c1747..50bfad3e360ddf73177c14d26667b7cdc54a98c1 100644
--- a/third_party/WebKit/Source/core/frame/csp/SourceListDirective.h
+++ b/third_party/WebKit/Source/core/frame/csp/SourceListDirective.h
@@ -92,12 +92,13 @@ class CORE_EXPORT SourceListDirective final : public CSPDirective {
   void addSourceHash(const ContentSecurityPolicyHashAlgorithm&,
                      const DigestValue& hash);
 
-  static void addSourceToMap(HashMap<String, CSPSource*>&, CSPSource*);
+  static void addSourceToMap(HeapHashMap<String, Member<CSPSource>>&,
+                             CSPSource*);
 
   bool hasSourceMatchInList(const KURL&, ResourceRequest::RedirectStatus) const;
   HeapVector<Member<CSPSource>> getIntersectCSPSources(
       HeapVector<Member<CSPSource>> other);
-  HashMap<String, CSPSource*> getIntersectSchemesOnly(
+  HeapHashMap<String, Member<CSPSource>> getIntersectSchemesOnly(
       HeapVector<Member<CSPSource>> other);
 
   Member<ContentSecurityPolicy> m_policy;