[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/HeapPage.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 153 matching lines @@
 
 static_assert(nonLargeObjectPageSizeMax >= blinkPageSize, "max size supported by HeapObjectHeader must at least be blinkPageSize");
 
 class PLATFORM_EXPORT HeapObjectHeader {
 public:
     // If gcInfoIndex is 0, this header is interpreted as a free list header.
     NO_SANITIZE_ADDRESS
     HeapObjectHeader(size_t size, size_t gcInfoIndex)
     {
 #if ENABLE(ASSERT)
-        m_magic = magic;
+        putGcGeneration();

[haraken, 2015/11/11 10:03:16]

Actually this is not quite right. Remember that HeapObjectHeader's constructor
is called for creating a FreeListEntry (which is a header for the free list
entry). The FreeListEntry should not have a valid m_gcGeneration.

I think we should add one more parameter 'gcGeneration' to the
HeapObjectHeader's constructor and explicitly pass the gcGeneration recorded to
the HeapObjectHeader.

[peria, 2015/11/12 14:38:42]

Done.

 #endif
         // sizeof(HeapObjectHeader) must be equal to or smaller than
         // allocationGranurarity, because HeapObjectHeader is used as a header
         // for an freed entry.  Given that the smallest entry size is
         // allocationGranurarity, HeapObjectHeader must fit into the size.
         static_assert(sizeof(HeapObjectHeader) <= allocationGranularity, "size of HeapObjectHeader must be smaller than allocationGranularity");
 #if CPU(64BIT)
         static_assert(sizeof(HeapObjectHeader) == 8, "size of HeapObjectHeader must be 8 byte aligned");
 #endif
 
@@ skipping 20 matching lines @@
     void unmark();
     void markDead();
     bool isDead() const;
 
     Address payload();
     size_t payloadSize();
     Address payloadEnd();
 
 #if ENABLE(ASSERT)
     bool checkHeader() const;
-    // Zap magic number with a new magic number that means there was once an
-    // object allocated here, but it was freed because nobody marked it during
-    // GC.
-    void zapMagic();
+
+    void putGcGeneration();

[haraken, 2015/11/11 10:03:16]

putGcGeneration => recordGCGeneration

[peria, 2015/11/12 14:38:42]

I removed this method with making gcGeneration a parameter of this constructor

+    void clearGcGeneration();
+    uint32_t gcGeneration() const { return m_gcGeneration; }
 #endif
 
     void finalize(Address, size_t);
     static HeapObjectHeader* fromPayload(const void*);
 
-    static const uint16_t magic = 0xfff1;
-    static const uint16_t zappedMagic = 0x4321;
-
 private:
     uint32_t m_encoded;
 #if ENABLE(ASSERT)
-    uint16_t m_magic;
+    uint32_t m_gcGeneration;

[haraken, 2015/11/11 10:03:16]

Add a comment.

// m_gcGeneration keeps track of the number of GC cycle where the object gets
allocated. m_gcGeneration == 0 indicates that the object has already been freed.

[peria, 2015/11/12 14:38:42]

Done.

 #endif
 
     // In 64 bit architectures, we intentionally add 4 byte padding immediately
     // after the HeapHeaderObject. This is because:
     //
     // | HeapHeaderObject (4 byte) | padding (4 byte) | object payload (8 * n byte) |
     // ^8 byte aligned                                ^8 byte aligned
     //
     // is better than:
     //
     // | HeapHeaderObject (4 byte) | object payload (8 * n byte) | padding (4 byte) |
     // ^4 byte aligned             ^8 byte aligned               ^4 byte aligned
     //
     // since the former layout aligns both header and payload to 8 byte.
 #if USE_4BYTE_HEADER_PADDING
 public:
     uint32_t m_padding;
 #endif
 };
 
 class FreeListEntry final : public HeapObjectHeader {
 public:
     NO_SANITIZE_ADDRESS
     explicit FreeListEntry(size_t size)
         : HeapObjectHeader(size, gcInfoIndexForFreeListHeader)
         , m_next(nullptr)
     {
 #if ENABLE(ASSERT)
         ASSERT(size >= sizeof(HeapObjectHeader));
-        zapMagic();
+        clearGcGeneration();
 #endif
     }
 
     Address address() { return reinterpret_cast<Address>(this); }
 
     NO_SANITIZE_ADDRESS
     void unlink(FreeListEntry** prevNext)
     {
         *prevNext = m_next;
         m_next = nullptr;
@@ skipping 505 matching lines @@
     // LargeObjectPage::m_payloadSize.
     ASSERT(result != largeObjectSizeInHeader);
     ASSERT(!pageFromObject(this)->isLargeObjectPage());
     return result;
 }
 
 #if ENABLE(ASSERT)
 NO_SANITIZE_ADDRESS inline
 bool HeapObjectHeader::checkHeader() const
 {
-    return !pageFromObject(this)->orphaned() && m_magic == magic;
+    return !pageFromObject(this)->orphaned() && m_gcGeneration;
 }
 #endif
 
 inline Address HeapObjectHeader::payload()
 {
     return reinterpret_cast<Address>(this) + sizeof(HeapObjectHeader);
 }
 
 inline Address HeapObjectHeader::payloadEnd()
 {
@@ skipping 72 matching lines @@
         SET_MEMORY_ACCESSIBLE(result, allocationSize - sizeof(HeapObjectHeader));
         ASSERT(findPageFromAddress(headerAddress + allocationSize - 1));
         return result;
     }
     return outOfLineAllocate(allocationSize, gcInfoIndex);
 }
 
 } // namespace blink
 
 #endif // HeapPage_h