Why this CL triggers an OilPan crash.

third_party/WebKit/Source/core/page/Page.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2012, 2013 Apple Inc. All
  * Rights Reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 43 matching lines @@
 #include "core/page/ValidationMessageClient.h"
 #include "core/page/scrolling/OverscrollController.h"
 #include "core/page/scrolling/ScrollingCoordinator.h"
 #include "core/page/scrolling/TopDocumentRootScrollerController.h"
 #include "core/paint/PaintLayer.h"
 #include "core/probe/CoreProbes.h"
 #include "platform/WebFrameScheduler.h"
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/loader/fetch/ResourceFetcher.h"
 #include "platform/plugins/PluginData.h"
+#include "platform/wtf/HashMap.h"
 #include "public/platform/Platform.h"
 
 namespace blink {
 
+namespace {
+
+using BrowsingInstanceHashMap = WTF::HashMap<int, Page::PageSet>;
+BrowsingInstanceHashMap& GetBrowsingInstanceHashMap() {
+  DEFINE_STATIC_LOCAL(BrowsingInstanceHashMap, browsing_instance_hash_map,
+                      ());
+  return browsing_instance_hash_map;
+}
+
+}  // namespace
+
 // Set of all live pages; includes internal Page objects that are
 // not observable from scripts.
 static Page::PageSet& AllPages() {
   DEFINE_STATIC_LOCAL(Page::PageSet, pages, ());
   return pages;
 }
 
 Page::PageSet& Page::OrdinaryPages() {
   DEFINE_STATIC_LOCAL(Page::PageSet, pages, ());
   return pages;
 }
 
+const Page::PageSet& Page::RelatedPages() {
+  DEFINE_STATIC_LOCAL(Page::PageSet, empty_page_set, ());
+  if (browsing_instance_id_ == Page::kUnknownBrowsingInstance)
+    return empty_page_set;
+
+  auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id_);
+  DCHECK_NE(GetBrowsingInstanceHashMap().end(), it);
+  return it->value;
+}
+
 float DeviceScaleFactorDeprecated(LocalFrame* frame) {
   if (!frame)
     return 1;
   Page* page = frame->GetPage();
   if (!page)
     return 1;
   return page->DeviceScaleFactorDeprecated();
 }
 
-Page* Page::CreateOrdinary(PageClients& page_clients) {
+Page* Page::CreateOrdinary(PageClients& page_clients,
+                           int browsing_instance_id) {
   Page* page = Create(page_clients);
+
+  page->browsing_instance_id_ = browsing_instance_id;
+  if (browsing_instance_id != Page::kUnknownBrowsingInstance) {
+    auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id);
+    if (it != GetBrowsingInstanceHashMap().end()) {
+      it->value.insert(page);
+    } else {
+      PageSet initial_set;
+      initial_set.insert(page);
+      GetBrowsingInstanceHashMap().insert(browsing_instance_id,
+                                          std::move(initial_set));
+    }
+  }
+
   OrdinaryPages().insert(page);
   if (ScopedPageSuspender::IsActive())
     page->SetSuspended(true);
   return page;
 }
 
 Page::Page(PageClients& page_clients)
     : SettingsDelegate(Settings::Create()),
       animator_(PageAnimator::Create(*this)),
       autoscroll_controller_(AutoscrollController::Create(*this)),
@@ skipping 549 matching lines @@
   Frame* main_frame = main_frame_;
 
   // TODO(sashab): Remove this check, the call to detach() here should always
   // work.
   if (main_frame->IsAttached())
     main_frame->Detach(FrameDetachType::kRemove);
 
   DCHECK(AllPages().Contains(this));
   AllPages().erase(this);
   OrdinaryPages().erase(this);
+  if (browsing_instance_id_ != Page::kUnknownBrowsingInstance) {
+    auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id_);
+    DCHECK_NE(GetBrowsingInstanceHashMap().end(), it);
+    PageSet& related_pages = it->value;
+    related_pages.erase(this);
+    if (related_pages.IsEmpty())
+      GetBrowsingInstanceHashMap().erase(browsing_instance_id_);
+  }
 
   if (scrolling_coordinator_)
     scrolling_coordinator_->WillBeDestroyed();
 
   GetChromeClient().ChromeDestroyed();
   if (validation_message_client_)
     validation_message_client_->WillBeDestroyed();
   main_frame_ = nullptr;
 
   PageVisibilityNotifier::NotifyContextDestroyed();
 }
 
 Page::PageClients::PageClients()
     : chrome_client(nullptr),
       context_menu_client(nullptr),
       editor_client(nullptr),
       spell_checker_client(nullptr) {}
 
 Page::PageClients::~PageClients() {}
 
 template class CORE_TEMPLATE_EXPORT Supplement<Page>;
 
 }  // namespace blink