Try adding memory corruption check in ThreadCache::Deallocate.

third_party/tcmalloc/chromium/src/free_list.cc

Index: third_party/tcmalloc/chromium/src/free_list.cc
diff --git a/third_party/tcmalloc/chromium/src/free_list.cc b/third_party/tcmalloc/chromium/src/free_list.cc
index 842f391c4593071dee2127063fde5a05f78f6913..61e9a1d1a36969b0978d1a01861b5b2bb6af8431 100644
--- a/third_party/tcmalloc/chromium/src/free_list.cc
+++ b/third_party/tcmalloc/chromium/src/free_list.cc
@@ -150,6 +150,7 @@ void *FL_Pop(void **list) {
   if (*list != NULL) {
     FL_SetPrevious(*list, NULL);
   }
+  // Maybe required here? : FL_SetNext(result, NULL);

[jar (doing other things), 2012/03/01 19:36:38]

An item pulled from the list is not guaranteed to have any specific contents, so
there is no real value in "cleaning up" the item that we popped.

[Dai Mikurube (NOT FULLTIME), 2012/03/01 21:04:11]

Make sense.  I don't change here.

   return result;
 }