[NOT TO COMMIT!] Merge Chromium-specific changes in tcmalloc thru. the original gperftools r136.

third_party/tcmalloc/chromium/src/page_heap_allocator.h

Index: third_party/tcmalloc/chromium/src/page_heap_allocator.h
diff --git a/third_party/tcmalloc/chromium/src/page_heap_allocator.h b/third_party/tcmalloc/chromium/src/page_heap_allocator.h
index d83528203f1a0ff935d72547753fe3f5f344102e..b1aa43398b5a210570c5d6ef6c52115a19a18bf3 100644
--- a/third_party/tcmalloc/chromium/src/page_heap_allocator.h
+++ b/third_party/tcmalloc/chromium/src/page_heap_allocator.h
@@ -36,7 +36,9 @@
 #include <stddef.h>                     // for NULL, size_t
 
 #include "common.h"            // for MetaDataAlloc
+#include "free_list.h"         // for FL_Push/FL_Pop
 #include "internal_logging.h"  // for ASSERT
+#include "system-alloc.h"      // for TCMalloc_SystemAddGuard
 
 namespace tcmalloc {
 
@@ -62,8 +64,7 @@ class PageHeapAllocator {
     // Consult free list
     void* result;
     if (free_list_ != NULL) {
-      result = free_list_;
-      free_list_ = *(reinterpret_cast<void**>(result));
+      result = FL_Pop(&free_list_);
     } else {
       if (free_avail_ < sizeof(T)) {
         // Need more room. We assume that MetaDataAlloc returns
@@ -75,7 +76,21 @@ class PageHeapAllocator {
               "tcmalloc data (bytes, object-size)",
               kAllocIncrement, sizeof(T));
         }
-        free_avail_ = kAllocIncrement;
+
+        // This guard page protects the metadata from being corrupted by a
+        // buffer overrun. We currently have no mechanism for freeing it, since
+        // we never release the metadata buffer. If that changes we'll need to
+        // add something like TCMalloc_SystemRemoveGuard.
+        size_t guard_size = TCMalloc_SystemAddGuard(free_area_,
+                                                    kAllocIncrement);
+        free_area_ += guard_size;
+        free_avail_ = kAllocIncrement - guard_size;
+        if (free_avail_ < sizeof(T)) {
+          Log(kCrash, __FILE__, __LINE__,
+              "FATAL ERROR: Insufficient memory to guard internal tcmalloc "
+              "data (%d bytes, object-size %d, guard-size %d)\n",
+              kAllocIncrement, static_cast<int>(sizeof(T)), guard_size);
+        }
       }
       result = free_area_;
       free_area_ += sizeof(T);
@@ -86,8 +101,7 @@ class PageHeapAllocator {
   }
 
   void Delete(T* p) {
-    *(reinterpret_cast<void**>(p)) = free_list_;
-    free_list_ = p;
+    FL_Push(&free_list_, p);
     inuse_--;
   }