Try adding memory corruption check in ThreadCache::Deallocate.

third_party/tcmalloc/chromium/src/thread_cache.h

Index: third_party/tcmalloc/chromium/src/thread_cache.h
diff --git a/third_party/tcmalloc/chromium/src/thread_cache.h b/third_party/tcmalloc/chromium/src/thread_cache.h
index d631f45284f9e817d883dcf7df450b7b7c49fe8d..62ab794f9b169b6b86b7f68c31e89d28ab3971c2 100644
--- a/third_party/tcmalloc/chromium/src/thread_cache.h
+++ b/third_party/tcmalloc/chromium/src/thread_cache.h
@@ -214,6 +214,12 @@ class ThreadCache {
       return FL_Pop(&list_);
     }
 
+    void* Next() {
+      if (list_ == NULL)
+        return NULL;
+      return FL_Next(list_);
+    }
+
     void PushRange(int N, void *start, void *end) {
       FL_PushRange(&list_, start, end);
       length_ += N;
@@ -366,6 +372,12 @@ inline void ThreadCache::Deallocate(void* ptr, size_t cl) {
   FreeList* list = &list_[cl];
   size_ += Static::sizemap()->ByteSizeForClass(cl);
   ssize_t size_headroom = max_size_ - size_ - 1;
+
+  // This catches back-to-back frees of allocs in the same size
+  // class. A more comprehensive (and expensive) test would be to walk
+  // the entire freelist. But this might be enough to find some bugs.
+  ASSERT(ptr != list->Next());
+
   list->Push(ptr);
   ssize_t list_headroom =
       static_cast<ssize_t>(list->max_length()) - list->length();