Try adding memory corruption check in ThreadCache::Deallocate.

third_party/tcmalloc/chromium/src/free_list.cc

 // Copyright (c) 2011, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 132 matching lines @@
 // |*list|, and updates |*list| to point to the next element in the
 // list.  Returns the address of the element that was removed from the
 // linked list.  |list| must not be NULL.
 void *FL_Pop(void **list) {
   void *result = *list;
   ASSERT(FL_Previous_No_Check(result) == NULL);
   *list = FL_Next(result);
   if (*list != NULL) {
     FL_SetPrevious(*list, NULL);
   }
+  // Maybe required here? : FL_SetNext(result, NULL);

[jar (doing other things), 2012/03/01 19:36:38]

An item pulled from the list is not guaranteed to have any specific contents, so
there is no real value in "cleaning up" the item that we popped.

[Dai Mikurube (NOT FULLTIME), 2012/03/01 21:04:11]

Make sense.  I don't change here.

   return result;
 }
 
 // Remove |n| elements from linked list at whose first element is at
 // |*head|.  |head| will be modified to point to the new head.
 // |start| will point to the first node of the range, |end| will point
 // to the last node in the range. |n| must be <= FL_Size(|*head|)
 // If |n| > 0, |head| must not be NULL.
 void FL_PopRange(void **head, int n, void **start, void **end) {
   if (n == 0) {
@@ skipping 57 matching lines @@
 
 namespace {
 
 inline void FL_SetNext(void *t, void *n) {
   tcmalloc::SLL_SetNext(t,n);
 }
 
 }
 
 #endif // TCMALLOC_USE_DOUBLYLINKED_FREELIST