Why this CL triggers an OilPan crash.

third_party/WebKit/Source/core/page/Page.cpp

Index: third_party/WebKit/Source/core/page/Page.cpp
diff --git a/third_party/WebKit/Source/core/page/Page.cpp b/third_party/WebKit/Source/core/page/Page.cpp
index 6dc4b2180bc29db3eaaf4c604531a8cad016befb..7434e654c3810739cb31701ddeb8c3765fe70512 100644
--- a/third_party/WebKit/Source/core/page/Page.cpp
+++ b/third_party/WebKit/Source/core/page/Page.cpp
@@ -61,10 +61,22 @@
 #include "platform/graphics/GraphicsLayer.h"
 #include "platform/loader/fetch/ResourceFetcher.h"
 #include "platform/plugins/PluginData.h"
+#include "platform/wtf/HashMap.h"
 #include "public/platform/Platform.h"
 
 namespace blink {
 
+namespace {
+
+using BrowsingInstanceHashMap = WTF::HashMap<int, Page::PageSet>;
+BrowsingInstanceHashMap& GetBrowsingInstanceHashMap() {
+  DEFINE_STATIC_LOCAL(BrowsingInstanceHashMap, browsing_instance_hash_map,
+                      ());
+  return browsing_instance_hash_map;
+}
+
+}  // namespace
+
 // Set of all live pages; includes internal Page objects that are
 // not observable from scripts.
 static Page::PageSet& AllPages() {
@@ -77,6 +89,16 @@ Page::PageSet& Page::OrdinaryPages() {
   return pages;
 }
 
+const Page::PageSet& Page::RelatedPages() {
+  DEFINE_STATIC_LOCAL(Page::PageSet, empty_page_set, ());
+  if (browsing_instance_id_ == Page::kUnknownBrowsingInstance)
+    return empty_page_set;
+
+  auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id_);
+  DCHECK_NE(GetBrowsingInstanceHashMap().end(), it);
+  return it->value;
+}
+
 float DeviceScaleFactorDeprecated(LocalFrame* frame) {
   if (!frame)
     return 1;
@@ -86,8 +108,23 @@ float DeviceScaleFactorDeprecated(LocalFrame* frame) {
   return page->DeviceScaleFactorDeprecated();
 }
 
-Page* Page::CreateOrdinary(PageClients& page_clients) {
+Page* Page::CreateOrdinary(PageClients& page_clients,
+                           int browsing_instance_id) {
   Page* page = Create(page_clients);
+
+  page->browsing_instance_id_ = browsing_instance_id;
+  if (browsing_instance_id != Page::kUnknownBrowsingInstance) {
+    auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id);
+    if (it != GetBrowsingInstanceHashMap().end()) {
+      it->value.insert(page);
+    } else {
+      PageSet initial_set;
+      initial_set.insert(page);
+      GetBrowsingInstanceHashMap().insert(browsing_instance_id,
+                                          std::move(initial_set));
+    }
+  }
+
   OrdinaryPages().insert(page);
   if (ScopedPageSuspender::IsActive())
     page->SetSuspended(true);
@@ -657,6 +694,14 @@ void Page::WillBeDestroyed() {
   DCHECK(AllPages().Contains(this));
   AllPages().erase(this);
   OrdinaryPages().erase(this);
+  if (browsing_instance_id_ != Page::kUnknownBrowsingInstance) {
+    auto it = GetBrowsingInstanceHashMap().find(browsing_instance_id_);
+    DCHECK_NE(GetBrowsingInstanceHashMap().end(), it);
+    PageSet& related_pages = it->value;
+    related_pages.erase(this);
+    if (related_pages.IsEmpty())
+      GetBrowsingInstanceHashMap().erase(browsing_instance_id_);
+  }
 
   if (scrolling_coordinator_)
     scrolling_coordinator_->WillBeDestroyed();