Correctly track cross-thread pending FetchEvents.

third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h

Index: third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
diff --git a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
index 2dd2328fdca07948ae0e0b43062321b6e22f52e2..143abe87479e1a117648d40186f151d5d693172a 100644
--- a/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
+++ b/third_party/WebKit/Source/web/ServiceWorkerGlobalScopeProxy.h
@@ -166,7 +166,15 @@ class ServiceWorkerGlobalScopeProxy final
 
   Member<ParentFrameTaskRunners> m_parentFrameTaskRunners;
 
-  HeapHashMap<int, Member<FetchEvent>> m_pendingPreloadFetchEvents;
+  // The worker thread uses this map to track |FetchEvent|s created
+  // on the worker thread (heap.) But as the proxy object is created
+  // on the main thread & its heap, we must use a cross-heap reference
+  // to each |FetchEvent| so as to obey the "per-thread heap rule" that
+  // a heap should only have per-thread heap references. Keeping a
+  // cross-heap reference requires the use of a CrossThreadPersistent<>
+  // to remain safe and sound.
+  //
+  HashMap<int, CrossThreadPersistent<FetchEvent>> m_pendingPreloadFetchEvents;
 
   WebServiceWorkerContextClient* m_client;