Catch some "easy to spot" double frees in TCMalloc

third_party/tcmalloc/chromium/src/free_list.cc

 // Copyright (c) 2011, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 44 matching lines @@
 // For both types of lists: when a pop operation is performed on a non
 // empty list, the new list head becomes that which is pointed to by
 // the former head's |next| pointer.  If the list is doubly linked, the
 // new head |previous| pointer gets changed from pointing to the former
 // head to NULL.
 
 
 #ifdef TCMALLOC_USE_DOUBLYLINKED_FREELIST
 
 #include <stddef.h>
-#include "internal_logging.h" //for ASSERT
+#include "free_list.h"
 
+// TODO(jar): We should use C++ rather than a macro here.
 #define MEMORY_CHECK(v1, v2) \
   if (v1 != v2) CRASH("Memory corruption detected.\n")
 
 namespace {
+void EnsureNonLoop(void* node, void* next) {
+  // We only have time to do minimal checking.  We don't traverse the list, but
+  // only look for an immediate loop (cycle back to ourself).
+  if (node != next) return;
+  CRASH("Circular loop in list detected: %p\n", next);
+}
+
 // Returns value of the |previous| pointer w/out running a sanity
 // check.
 inline void *FL_Previous_No_Check(void *t) {
   return reinterpret_cast<void**>(t)[1];
 }
 
 // Returns value of the |next| pointer w/out running a sanity check.
 inline void *FL_Next_No_Check(void *t) {
   return reinterpret_cast<void**>(t)[0];
 }
 
 void *FL_Previous(void *t) {
   void *previous = FL_Previous_No_Check(t);
   if (previous) {
     MEMORY_CHECK(FL_Next_No_Check(previous), t);
   }
   return previous;
 }
 
 inline void FL_SetPrevious(void *t, void *n) {
+  EnsureNonLoop(t, n);
   reinterpret_cast<void**>(t)[1] = n;
 }
 
 inline void FL_SetNext(void *t, void *n) {
+  EnsureNonLoop(t, n);
   reinterpret_cast<void**>(t)[0] = n;
 }
 
 } // namespace
 
 namespace tcmalloc {
 
 void *FL_Next(void *t) {
   void *next = FL_Next_No_Check(t);
   if (next) {
@@ skipping 105 matching lines @@
 
 namespace {
 
 inline void FL_SetNext(void *t, void *n) {
   tcmalloc::SLL_SetNext(t,n);
 }
 
 }
 
 #endif // TCMALLOC_USE_DOUBLYLINKED_FREELIST