Try adding memory corruption check in ThreadCache::Deallocate.

third_party/tcmalloc/chromium/src/thread_cache.h

 // Copyright (c) 2008, Google Inc.
 // All rights reserved.
 //
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 // notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
@@ skipping 196 matching lines @@
       length_++;
     }
 
     void* Pop() {
       ASSERT(list_ != NULL);
       length_--;
       if (length_ < lowater_) lowater_ = length_;
       return FL_Pop(&list_);
     }
 
+    void* Next() {
+      if (list_ == NULL)
+        return NULL;
+      return FL_Next(list_);
+    }
+
     void PushRange(int N, void *start, void *end) {
       FL_PushRange(&list_, start, end);
       length_ += N;
     }
 
     void PopRange(int N, void **start, void **end) {
       FL_PopRange(&list_, N, start, end);
       ASSERT(length_ >= N);
       length_ -= N;
       if (length_ < lowater_) lowater_ = length_;
@@ skipping 132 matching lines @@
     return FetchFromCentralCache(cl, size);
   }
   size_ -= size;
   return list->Pop();
 }
 
 inline void ThreadCache::Deallocate(void* ptr, size_t cl) {
   FreeList* list = &list_[cl];
   size_ += Static::sizemap()->ByteSizeForClass(cl);
   ssize_t size_headroom = max_size_ - size_ - 1;
+
+  // This catches back-to-back frees of allocs in the same size
+  // class. A more comprehensive (and expensive) test would be to walk
+  // the entire freelist. But this might be enough to find some bugs.
+  ASSERT(ptr != list->Next());
+
   list->Push(ptr);
   ssize_t list_headroom =
       static_cast<ssize_t>(list->max_length()) - list->length();
 
   // There are two relatively uncommon things that require further work.
   // In the common case we're done, and in that case we need a single branch
   // because of the bitwise-or trick that follows.
   if ((list_headroom | size_headroom) < 0) {
     if (list_headroom < 0) {
       ListTooLong(list, cl);
@@ skipping 27 matching lines @@
 // because we may be in the thread destruction code and may have
 // already cleaned up the cache for this thread.
 inline ThreadCache* ThreadCache::GetCacheIfPresent() {
   if (!tsd_inited_) return NULL;
   return GetThreadHeap();
 }
 
 }  // namespace tcmalloc
 
 #endif  // TCMALLOC_THREAD_CACHE_H_