[Oilpan]: Make StylePropertySet fully garbage collected.

Source/core/dom/ElementDataCache.cpp

 /*
  * Copyright (C) 2012, 2013 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 25 matching lines @@
     return StringHasher::hashMemory(attributes.data(), attributes.size() * sizeof(Attribute));
 }
 
 inline bool hasSameAttributes(const Vector<Attribute>& attributes, ShareableElementData& elementData)
 {
     if (attributes.size() != elementData.length())
         return false;
     return !memcmp(attributes.data(), elementData.m_attributeArray, attributes.size() * sizeof(Attribute));
 }
 
-PassRefPtr<ShareableElementData> ElementDataCache::cachedShareableElementDataWithAttributes(const Vector<Attribute>& attributes)
+PassRefPtrWillBeRawPtr<ShareableElementData> ElementDataCache::cachedShareableElementDataWithAttributes(const Vector<Attribute>& attributes)
 {
     ASSERT(!attributes.isEmpty());
 
-    ShareableElementDataCache::ValueType* it = m_shareableElementDataCache.add(attributeHash(attributes), nullptr).storedValue;
-
+    ShareableElementData* elementData = m_shareableElementDataCache.get(attributeHash(attributes));
     // FIXME: This prevents sharing when there's a hash collision.
-    if (it->value && !hasSameAttributes(attributes, *it->value))
+    if (elementData && !hasSameAttributes(attributes, *elementData))
         return ShareableElementData::createWithAttributes(attributes);
 
-    if (!it->value)
-        it->value = ShareableElementData::createWithAttributes(attributes);
-
-    return it->value.get();
+    if (!elementData)
+        elementData = m_shareableElementDataCache.set(attributeHash(attributes), ShareableElementData::createWithAttributes(attributes)).storedValue->value.get();

[esprehn, 2014/05/14 20:25:27]

You make us do two hash lookups now instead of one, this is wrong.

[wibling-chromium, 2014/05/15 13:15:18]

The reason is that the createWithAttributes call might trigger a GC which could
cause the backing of the hash map to be reallocated (ie. moved). In that case
the pointer to the storedValue would be incorrect.

+    ASSERT(elementData);
+    return elementData;
 }
 
 ElementDataCache::ElementDataCache()
 {
 }
 
 ElementDataCache::~ElementDataCache()
 {
 }
 
 }