(CANCELED) Forbid GC during copyToVector()

third_party/WebKit/Source/wtf/HashCountedSet.h

Index: third_party/WebKit/Source/wtf/HashCountedSet.h
diff --git a/third_party/WebKit/Source/wtf/HashCountedSet.h b/third_party/WebKit/Source/wtf/HashCountedSet.h
index 6d99b5fc71aca86cf385f7f8bcf21c2210367a29..dd23575a468ccb0a051a0424e50845f24cda2750 100644
--- a/third_party/WebKit/Source/wtf/HashCountedSet.h
+++ b/third_party/WebKit/Source/wtf/HashCountedSet.h
@@ -162,11 +162,10 @@ template <typename Value,
 inline void copyToVector(
     const HashCountedSet<Value, HashFunctions, Traits, Allocator>& collection,
     VectorType& vector) {
-  {
-    // Disallow GC across resize allocation, see crbug.com/568173
-    typename VectorType::GCForbiddenScope scope;
-    vector.resize(collection.size());
-  }
+  // Disallow GC across resize and iterations, see crbug.com/568173
+  typename VectorType::GCForbiddenScope scope;
+
+  vector.resize(collection.size());
 
   auto it = collection.begin();
   auto end = collection.end();