[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/HeapPage.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 71 matching lines @@
     }
 #else
 #define ENABLE_ASAN_CONTAINER_ANNOTATIONS 0
 #define ASAN_RETIRE_CONTAINER_ANNOTATION(payload, payloadSize)
 #define ASAN_MARK_LARGE_VECTOR_CONTAINER(heap, largeObject)
 #endif
 
 namespace blink {
 
 #if ENABLE(ASSERT)
+void HeapObjectHeader::putGcGeneration()
+{
+    m_gcGeneration = Heap::gcGeneration();
+}
+
 NO_SANITIZE_ADDRESS
-void HeapObjectHeader::zapMagic()
+void HeapObjectHeader::clearGcGeneration()
 {
     ASSERT(checkHeader());
-    m_magic = zappedMagic;
+    m_gcGeneration = 0;
 }
 #endif
 
 void HeapObjectHeader::finalize(Address object, size_t objectSize)
 {
     const GCInfo* gcInfo = Heap::gcInfo(gcInfoIndex());
     if (gcInfo->hasFinalizer())
         gcInfo->m_finalize(object);
 
     ASAN_RETIRE_CONTAINER_ANNOTATION(object, objectSize);
@@ skipping 1477 matching lines @@
 
     m_hasEntries = true;
     size_t index = hash(address);
     ASSERT(!(index & 1));
     Address cachePage = roundToBlinkPageStart(address);
     m_entries[index + 1] = m_entries[index];
     m_entries[index] = cachePage;
 }
 
 } // namespace blink