Code: void HTMLDocument::addItemToMap(HashCountedSet<StringImpl*>& map, const AtomicString& name)
 {
     if (name.isEmpty())
         return;
    map.add(name.impl());
     if (Frame* f = frame())
         f->script()->namedItemAdded(this, name);
 }

Vulnerability Type: DoS 
CWE ID: CWE-399
Summary: Use-after-free vulnerability in Google Chrome before 31.0.1650.48 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving the string values of id attributes.
Commit Message: Fix tracking of the id attribute string if it is shared across elements.

The patch to remove AtomicStringImpl:
http://src.chromium.org/viewvc/blink?view=rev&rev=154790

Exposed a lifetime issue with strings for id attributes. We simply need to use
AtomicString.

BUG=290566

Review URL: https://codereview.chromium.org/33793004

git-svn-id: svn://svn.chromium.org/blink/trunk@160250 bbb929c8-8fbe-4397-9dbb-9b2b20218538