Correctly track cross-thread pending FetchEvents.

third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 148 matching lines @@
   Document& document() const;
   ServiceWorkerGlobalScope* workerGlobalScope() const;
 
   // Non-null until the WebEmbeddedWorkerImpl explicitly detach()es
   // as part of its finalization.
   WebEmbeddedWorkerImpl* m_embeddedWorker;
   Member<Document> m_document;
 
   Member<ParentFrameTaskRunners> m_parentFrameTaskRunners;
 
-  HeapHashMap<int, Member<FetchEvent>> m_pendingPreloadFetchEvents;
+  // The worker thread uses this map to track |FetchEvent|s created
+  // on the worker thread (heap.) But as the proxy object is created
+  // on the main thread & its heap, we must use a cross-heap reference
+  // to each |FetchEvent| so as to obey the "per-thread heap rule" that
+  // a heap should only have per-thread heap references. Keeping a
+  // cross-heap reference requires the use of a CrossThreadPersistent<>
+  // to remain safe and sound.
+  //
+  HashMap<int, CrossThreadPersistent<FetchEvent>> m_pendingPreloadFetchEvents;
 
   WebServiceWorkerContextClient* m_client;
 
   CrossThreadPersistent<ServiceWorkerGlobalScope> m_workerGlobalScope;
 };
 
 }  // namespace blink
 
 #endif  // ServiceWorkerGlobalScopeProxy_h