Oilpan: fix use of uninitialized raw pointers on the stack.

Source/core/css/parser/CSSPropertyParser.cpp

 /*
  * Copyright (C) 2003 Lars Knoll (knoll@kde.org)
  * Copyright (C) 2005 Allan Sandfeld Jensen (kde@carewolf.com)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011, 2012 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  * Copyright (C) 2012 Adobe Systems Incorporated. All rights reserved.
  * Copyright (C) 2012 Intel Corporation. All rights reserved.
  *
@@ skipping 3114 matching lines @@
         return cssValuePool().createIdentifierValue(result);
     if (equalIgnoringCase(value, "none"))
         return cssValuePool().createIdentifierValue(CSSValueNone);
     if (equalIgnoringCase(value, "inherit") || equalIgnoringCase(value, "initial"))
         return nullptr;
     return createPrimitiveStringValue(value);
 }
 
 bool CSSPropertyParser::parseWebkitTransformOriginShorthand(bool important)
 {
-    RefPtrWillBeRawPtr<CSSValue> originX;
-    RefPtrWillBeRawPtr<CSSValue> originY;
-    RefPtrWillBeRawPtr<CSSValue> originZ;
+    RefPtrWillBeRawPtr<CSSValue> originX = nullptr;
+    RefPtrWillBeRawPtr<CSSValue> originY = nullptr;
+    RefPtrWillBeRawPtr<CSSValue> originZ = nullptr;
 
     parse2ValuesFillPosition(m_valueList.get(), originX, originY);
 
     if (m_valueList->current()) {
         if (!validUnit(m_valueList->current(), FLength))
             return false;
         originZ = createPrimitiveNumericValue(m_valueList->current());
         m_valueList->next();
     } else {
         originZ = cssValuePool().createImplicitInitialValue();
@@ skipping 5341 matching lines @@
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueFill));
     if (!seenStroke)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueStroke));
     if (!seenMarkers)
         parsedValues->append(CSSPrimitiveValue::createIdentifier(CSSValueMarkers));
 
     return parsedValues.release();
 }
 
 } // namespace blink