[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/Heap.cpp

 /*
  * Copyright (C) 2013 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 154 matching lines @@
     s_allocatedObjectSize = 0;
     s_objectSizeAtLastGC = 0;
     s_markedObjectSize = 0;
     s_markedObjectSizeAtLastCompleteSweep = 0;
     s_wrapperCount = 0;
     s_wrapperCountAtLastGC = 0;
     s_collectedWrapperCount = 0;
     s_partitionAllocSizeAtLastGC = WTF::Partitions::totalSizeOfCommittedPages();
     s_estimatedMarkingTimePerByte = 0.0;
 #if ENABLE(ASSERT)
-    s_gcGeneration = 1;
+    s_gcGeneration = gcGenerationStart;
 #endif
 
     GCInfoTable::init();
 
     if (Platform::current() && Platform::current()->currentThread())
         Platform::current()->registerMemoryDumpProvider(BlinkGCMemoryDumpProvider::instance(), "BlinkGC");
 }
 
 void Heap::shutdown()
 {
@@ skipping 264 matching lines @@
     Platform::current()->histogramCustomCounts("BlinkGC.CollectGarbage", markingTimeInMilliseconds, 0, 10 * 1000, 50);
     Platform::current()->histogramCustomCounts("BlinkGC.TotalObjectSpace", Heap::allocatedObjectSize() / 1024, 0, 4 * 1024 * 1024, 50);
     Platform::current()->histogramCustomCounts("BlinkGC.TotalAllocatedSpace", Heap::allocatedSpace() / 1024, 0, 4 * 1024 * 1024, 50);
     Platform::current()->histogramEnumeration("BlinkGC.GCReason", reason, BlinkGC::NumberOfGCReason);
     Heap::reportMemoryUsageHistogram();
     WTF::Partitions::reportMemoryUsageHistogram();
 
     postGC(gcType);
 
 #if ENABLE(ASSERT)
-    // 0 is used to figure non-assigned area, so avoid to use 0 in s_gcGeneration.
+    // 0 and 1 are used to figure specific states in gcGeneration.
     if (++s_gcGeneration == 0) {
-        s_gcGeneration = 1;
+        s_gcGeneration = gcGenerationStart;
     }
 #endif
 
     if (state->isMainThread())
         ScriptForbiddenScope::exit();
 }
 
 void Heap::collectGarbageForTerminatingThread(ThreadState* state)
 {
     {
@@ skipping 292 matching lines @@
 size_t Heap::s_allocatedSpace = 0;
 size_t Heap::s_allocatedObjectSize = 0;
 size_t Heap::s_objectSizeAtLastGC = 0;
 size_t Heap::s_markedObjectSize = 0;
 size_t Heap::s_markedObjectSizeAtLastCompleteSweep = 0;
 size_t Heap::s_wrapperCount = 0;
 size_t Heap::s_wrapperCountAtLastGC = 0;
 size_t Heap::s_collectedWrapperCount = 0;
 size_t Heap::s_partitionAllocSizeAtLastGC = 0;
 double Heap::s_estimatedMarkingTimePerByte = 0.0;
-#if ENABLE(ASSERT)
-uint16_t Heap::s_gcGeneration = 0;
-#endif
+uint32_t Heap::s_gcGeneration = gcGenerationUnchecked;
 
 } // namespace blink