[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/ThreadState.h

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 275 matching lines @@
     // makeConsistentForMutator() drops marks from marked objects and rebuild
     // free lists. This is called after taking a snapshot and before resuming
     // the executions of mutators.
     void makeConsistentForMutator();
 
     // Support for disallowing allocation. Mainly used for sanity
     // checks asserts.
     bool isAllocationAllowed() const { return !isAtSafePoint() && !m_noAllocationCount; }
     void enterNoAllocationScope() { m_noAllocationCount++; }
     void leaveNoAllocationScope() { m_noAllocationCount--; }
-    bool isGCForbidden() const { return m_gcForbiddenCount; }
+
+    // By entering a gc-forbidden scope, conservative GCs will not
+    // be allowed while handling an out-of-line allocation request.
+    // Intended used when constructing subclasses of GC mixins, where
+    // the object being constructed cannot be safely traced & marked
+    // fully should a GC be allowed while its subclasses are being
+    // constructed.
+    bool isGCForbidden() const { return m_gcForbiddenCount || isConstructingGCMixin(); }
     void enterGCForbiddenScope() { m_gcForbiddenCount++; }
     void leaveGCForbiddenScope()
     {
         ASSERT(m_gcForbiddenCount > 0);
         m_gcForbiddenCount--;
     }
     bool sweepForbidden() const { return m_sweepForbidden; }
 
+    bool isConstructingGCMixin() const { return m_gcMixinMarker; }
+    void startConstructingGCMixin(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
+    {
+        ASSERT(checkThread());
+        if (!m_gcMixinMarker) {
+            m_gcMixinMarker = gcMixinMarker;
+        }
+    }
+    void finishConstructingGCMixin(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
+    {
+        ASSERT(checkThread());
+        if (m_gcMixinMarker == gcMixinMarker) {
+            m_gcMixinMarker = nullptr;
+        }
+    }
+
     void flushHeapDoesNotContainCacheIfNeeded();
 
     // Safepoint related functionality.
     //
     // When a thread attempts to perform GC it needs to stop all other threads
     // that use the heap or at least guarantee that they will not touch any
     // heap allocated object until GC is complete.
     //
     // We say that a thread is at a safepoint if this thread is guaranteed to
     // not touch any heap allocated object or any heap related functionality until
@@ skipping 109 matching lines @@
     }
 
     void shouldFlushHeapDoesNotContainCache() { m_shouldFlushHeapDoesNotContainCache = true; }
 
     void registerTraceDOMWrappers(v8::Isolate* isolate, void (*traceDOMWrappers)(v8::Isolate*, Visitor*))
     {
         m_isolate = isolate;
         m_traceDOMWrappers = traceDOMWrappers;
     }
 
-    // By entering a gc-forbidden scope, conservative GCs will not
-    // be allowed while handling an out-of-line allocation request.
-    // Intended used when constructing subclasses of GC mixins, where
-    // the object being constructed cannot be safely traced & marked
-    // fully should a GC be allowed while its subclasses are being
-    // constructed.
-    void enterGCForbiddenScopeIfNeeded(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
-    {
-        ASSERT(checkThread());
-        if (!m_gcMixinMarker) {
-            enterGCForbiddenScope();
-            m_gcMixinMarker = gcMixinMarker;
-        }
-    }
-    void leaveGCForbiddenScopeIfNeeded(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
-    {
-        ASSERT(checkThread());
-        if (m_gcMixinMarker == gcMixinMarker) {
-            leaveGCForbiddenScope();
-            m_gcMixinMarker = nullptr;
-        }
-    }
-
     // vectorBackingHeap() returns a heap that the vector allocation should use.
     // We have four vector heaps and want to choose the best heap here.
     //
     // The goal is to improve the succession rate where expand and
     // promptlyFree happen at an allocation point. This is a key for reusing
     // the same memory as much as possible and thus improves performance.
     // To achieve the goal, we use the following heuristics:
     //
     // - A vector that has been expanded recently is likely to be expanded
     //   again soon.
@@ skipping 207 matching lines @@
 };
 
 template<> class ThreadStateFor<AnyThread> {
 public:
     static ThreadState* state() { return ThreadState::current(); }
 };
 
 } // namespace blink
 
 #endif // ThreadState_h