[oilpan] Null pointers must be treated as live, since they can't be marked live by strongification

Source/platform/heap/HeapTest.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 4207 matching lines @@
     EXPECT_EQ(2, OffHeapInt::s_destructorCalls);
     EXPECT_EQ(2u, map1->size());
     Iterator i1 = map1->begin();
     EXPECT_TRUE(i1->value.first->value() == 103 || i1->value.first == livingInt);
     EXPECT_EQ(livingInt, i1->value.second);
     ++i1;
     EXPECT_TRUE(i1->value.first->value() == 103 || i1->value.first == livingInt);
     EXPECT_EQ(livingInt, i1->value.second);
 }
 
+static void addElementsToWeakMap(HeapHashMap<int, WeakMember<IntWrapper> >* map)
+{
+    // Key cannot be zero in hashmap.
+    for (int i = 1; i < 11; i++)
+        map->add(i, IntWrapper::create(i));
+}
+
+// crbug.com/402426
+// If it doesn't assert a concurrent modification to the map, then it's passing.
+TEST(HeapTest, RegressNullIsStrongified)
+{
+    Persistent<HeapHashMap<int, WeakMember<IntWrapper> > > map = new HeapHashMap<int, WeakMember<IntWrapper> >();
+    addElementsToWeakMap(map);
+    HeapHashMap<int, WeakMember<IntWrapper> >::AddResult result = map->add(800, nullptr);
+    Heap::collectGarbage(ThreadState::HeapPointersOnStack);
+    result.storedValue->value = IntWrapper::create(42);
+}
+
 TEST(HeapTest, Bind)
 {
     Closure closure = bind(&Bar::trace, Bar::create(), static_cast<Visitor*>(0));
     Heap::collectGarbage(ThreadState::NoHeapPointersOnStack);
     // The closure should have a persistent handle to the Bar.
     EXPECT_EQ(1u, Bar::s_live);
 
     Closure closure2 = bind(&Bar::trace, RawPtr<Bar>(Bar::create()), static_cast<Visitor*>(0));
     Heap::collectGarbage(ThreadState::NoHeapPointersOnStack);
     // The closure should have a persistent handle to the Bar.
@@ skipping 787 matching lines @@
     {
         TraceIfNeededTester<HeapVector<Member<SimpleObject> > >* m_vec = TraceIfNeededTester<HeapVector<Member<SimpleObject> > >::create();
         m_vec->obj().append(SimpleObject::create());
         visitor.reset();
         m_vec->trace(&visitor);
         EXPECT_EQ(2u, visitor.count());
     }
 }
 
 } // namespace blink