[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/HeapAllocator.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef HeapAllocator_h
 #define HeapAllocator_h
 
 #include "platform/heap/Heap.h"
 #include "platform/heap/TraceTraits.h"
 #include "wtf/Assertions.h"
@@ skipping 23 matching lines @@
         RELEASE_ASSERT(count <= maxHeapObjectSize / sizeof(T));
         return Heap::allocationSizeFromSize(count * sizeof(T)) - sizeof(HeapObjectHeader);
     }
     template <typename T>
     static T* allocateVectorBacking(size_t size)
     {
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->isAllocationAllowed());
         size_t gcInfoIndex = GCInfoTrait<HeapVectorBacking<T, VectorTraits<T>>>::index();
         NormalPageHeap* heap = static_cast<NormalPageHeap*>(state->vectorBackingHeap(gcInfoIndex));
-        return reinterpret_cast<T*>(heap->allocateObject(Heap::allocationSizeFromSize(size), gcInfoIndex));
+        return reinterpret_cast<T*>(heap->allocateObject(Heap::allocationSizeFromSize(size), gcInfoIndex, Heap::gcGeneration()));
     }
     template <typename T>
     static T* allocateExpandedVectorBacking(size_t size)
     {
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         ASSERT(state->isAllocationAllowed());
         size_t gcInfoIndex = GCInfoTrait<HeapVectorBacking<T, VectorTraits<T>>>::index();
         NormalPageHeap* heap = static_cast<NormalPageHeap*>(state->expandedVectorBackingHeap(gcInfoIndex));
-        return reinterpret_cast<T*>(heap->allocateObject(Heap::allocationSizeFromSize(size), gcInfoIndex));
+        return reinterpret_cast<T*>(heap->allocateObject(Heap::allocationSizeFromSize(size), gcInfoIndex, Heap::gcGeneration()));
     }
     static void freeVectorBacking(void*);
     static bool expandVectorBacking(void*, size_t);
     static bool shrinkVectorBacking(void* address, size_t quantizedCurrentSize, size_t quantizedShrunkSize);
     template <typename T>
     static T* allocateInlineVectorBacking(size_t size)
     {
         size_t gcInfoIndex = GCInfoTrait<HeapVectorBacking<T, VectorTraits<T>>>::index();
         ThreadState* state = ThreadStateFor<ThreadingTrait<T>::Affinity>::state();
         return reinterpret_cast<T*>(Heap::allocateOnHeapIndex(state, size, BlinkGC::InlineVectorHeapIndex, gcInfoIndex));
@@ skipping 323 matching lines @@
     template<size_t otherCapacity>
     HeapDeque(const HeapDeque<T, otherCapacity>& other)
         : Deque<T, inlineCapacity, HeapAllocator>(other)
     {
     }
 };
 
 } // namespace blink
 
 #endif