Disallow off-heap containers containing raw on-heap pointers.

third_party/WebKit/Source/wtf/HashSet.h

Index: third_party/WebKit/Source/wtf/HashSet.h
diff --git a/third_party/WebKit/Source/wtf/HashSet.h b/third_party/WebKit/Source/wtf/HashSet.h
index 72b97fcd01be40bcd511827674085712d296436d..268ec6a3c0841d822d3fa5f0fc8b8e4c7cb71851 100644
--- a/third_party/WebKit/Source/wtf/HashSet.h
+++ b/third_party/WebKit/Source/wtf/HashSet.h
@@ -63,7 +63,12 @@ class HashSet {
       const_iterator;
   typedef typename HashTableType::AddResult AddResult;
 
-  HashSet() = default;
+  HashSet() {
+    static_assert(Allocator::isGarbageCollected ||
+                      !IsPointerToGarbageCollectedType<ValueArg>::value,
+                  "Cannot put raw pointers to garbage-collected classes into "
+                  "an off-heap HashSet. Use HeapHashSet<Member<T>> instead.");
+  }
   HashSet(const HashSet&) = default;
   HashSet& operator=(const HashSet&) = default;
   HashSet(HashSet&&) = default;