TraceWrapperMember crashes when used as a value type of HeapHashMap

third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp

Index: third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp b/third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp
index 3a3b637acd1e14c04beb1355fd09ed4b988f5117..6d528610bb762fb776691f73d01f7aa424c33c1f 100644
--- a/third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/TraceWrapperMemberTest.cpp
@@ -9,9 +9,9 @@
 
 namespace blink {
 
-TEST(TraceWrapperMemberTest, HeapVectorSwap) {
-  typedef TraceWrapperMember<DeathAwareScriptWrappable> Wrapper;
+using Wrapper = TraceWrapperMember<DeathAwareScriptWrappable>;
 
+TEST(TraceWrapperMemberTest, HeapVectorSwap) {
   HeapVector<Wrapper> vector1;
   DeathAwareScriptWrappable* parent1 = DeathAwareScriptWrappable::create();
   DeathAwareScriptWrappable* child1 = DeathAwareScriptWrappable::create();
@@ -28,8 +28,6 @@ TEST(TraceWrapperMemberTest, HeapVectorSwap) {
 }
 
 TEST(TraceWrapperMemberTest, HeapVectorSwap2) {
-  typedef TraceWrapperMember<DeathAwareScriptWrappable> Wrapper;
-
   HeapVector<Wrapper> vector1;
   DeathAwareScriptWrappable* parent1 = DeathAwareScriptWrappable::create();
   DeathAwareScriptWrappable* child1 = DeathAwareScriptWrappable::create();
@@ -47,4 +45,43 @@ TEST(TraceWrapperMemberTest, HeapVectorSwap2) {
   EXPECT_EQ(child1, vector2.front().get());
 }
 
+TEST(TraceWrapperMemberTest, HeapHashSet) {
+  HeapHashSet<Wrapper> set;
+  DeathAwareScriptWrappable* parent = DeathAwareScriptWrappable::create();
+
+  for (int i = 0; i < 10000; ++i) {
+    DeathAwareScriptWrappable* child = DeathAwareScriptWrappable::create();
+    set.insert(Wrapper(parent, child));
+  }
+  EXPECT_EQ(10000u, set.size());
+
+  HeapHashSet<Wrapper> set2;
+  swap(set, set2);
+  EXPECT_EQ(0u, set.size());
+  EXPECT_EQ(10000u, set2.size());
+
+  for (int i = 0; i < 10000; ++i) {
+    set2.takeAny();
+  }
+
+  EXPECT_EQ(0u, set2.size());
+}
+
+TEST(TraceWrapperMemberTest, HeapHashMapValue) {
+  HeapHashMap<int, Wrapper> map;
+  DeathAwareScriptWrappable* parent = DeathAwareScriptWrappable::create();
+
+  for (int i = 0; i < 10000; ++i) {

[kouhei (in TOK), 2017/03/31 05:59:20]

OK This was because HashMap key should never be 0.

+    DeathAwareScriptWrappable* child = DeathAwareScriptWrappable::create();
+    map.insert(i, Wrapper(parent, child));
+  }
+  EXPECT_EQ(10000u, map.size());
+
+  for (int i = 0; i < 10000; ++i) {
+    map.take(i);
+  }
+
+  EXPECT_EQ(0u, map.size());
+}
+
 }  // namespace blink