[Oilpan]: Make StylePropertySet fully garbage collected.

Source/core/dom/ElementDataCache.cpp

Index: Source/core/dom/ElementDataCache.cpp
diff --git a/Source/core/dom/ElementDataCache.cpp b/Source/core/dom/ElementDataCache.cpp
index 8bdbf92705ec81566275a4a8322153701b983fdc..f4d761711a586801b14b8227bf20aba1de3c2f65 100644
--- a/Source/core/dom/ElementDataCache.cpp
+++ b/Source/core/dom/ElementDataCache.cpp
@@ -43,20 +43,19 @@ inline bool hasSameAttributes(const Vector<Attribute>& attributes, ShareableElem
     return !memcmp(attributes.data(), elementData.m_attributeArray, attributes.size() * sizeof(Attribute));
 }
 
-PassRefPtr<ShareableElementData> ElementDataCache::cachedShareableElementDataWithAttributes(const Vector<Attribute>& attributes)
+PassRefPtrWillBeRawPtr<ShareableElementData> ElementDataCache::cachedShareableElementDataWithAttributes(const Vector<Attribute>& attributes)
 {
     ASSERT(!attributes.isEmpty());
 
-    ShareableElementDataCache::ValueType* it = m_shareableElementDataCache.add(attributeHash(attributes), nullptr).storedValue;
-
+    ShareableElementData* elementData = m_shareableElementDataCache.get(attributeHash(attributes));
     // FIXME: This prevents sharing when there's a hash collision.
-    if (it->value && !hasSameAttributes(attributes, *it->value))
+    if (elementData && !hasSameAttributes(attributes, *elementData))
         return ShareableElementData::createWithAttributes(attributes);
 
-    if (!it->value)
-        it->value = ShareableElementData::createWithAttributes(attributes);
-
-    return it->value.get();
+    if (!elementData)
+        elementData = m_shareableElementDataCache.set(attributeHash(attributes), ShareableElementData::createWithAttributes(attributes)).storedValue->value.get();

[esprehn, 2014/05/14 20:25:27]

You make us do two hash lookups now instead of one, this is wrong.

[wibling-chromium, 2014/05/15 13:15:18]

The reason is that the createWithAttributes call might trigger a GC which could
cause the backing of the hash map to be reallocated (ie. moved). In that case
the pointer to the storedValue would be incorrect.

+    ASSERT(elementData);
+    return elementData;
 }
 
 ElementDataCache::ElementDataCache()