[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/GarbageCollected.h

Index: third_party/WebKit/Source/platform/heap/GarbageCollected.h
diff --git a/third_party/WebKit/Source/platform/heap/GarbageCollected.h b/third_party/WebKit/Source/platform/heap/GarbageCollected.h
index d9abbd3a2af03f801b57b211bcde0a65a25b1231..60b14dfa02e32625f9de0d05cdafb6a8aaa5d4b6 100644
--- a/third_party/WebKit/Source/platform/heap/GarbageCollected.h
+++ b/third_party/WebKit/Source/platform/heap/GarbageCollected.h
@@ -128,6 +128,7 @@ public:
     virtual void adjustAndMark(InlinedGlobalMarkingVisitor) const = 0;
     virtual void trace(InlinedGlobalMarkingVisitor);
     virtual bool isHeapObjectAlive() const = 0;

[haraken, 2015/11/11 10:03:16]

In a follow-up, I hope we can remove this. If we have heapObjectHeader(),
isHeapObjectAlive() won't be needed.

[peria, 2015/11/12 14:38:41]

Acknowledged.

+    virtual HeapObjectHeader* heapObjectHeader() const = 0;
 };
 
 #define DEFINE_GARBAGE_COLLECTED_MIXIN_METHODS(VISITOR, TYPE)           \
@@ -171,7 +172,7 @@ public:
 {                                                                       \
         void* object = TYPE::allocateObject(size, IsEagerlyFinalizedType<TYPE>::value); \
         ThreadState* state = ThreadStateFor<ThreadingTrait<TYPE>::Affinity>::state();   \
-        state->enterGCForbiddenScopeIfNeeded(&(reinterpret_cast<TYPE*>(object)->m_mixinConstructorMarker)); \
+        state->startConstructingGCMixin(&(reinterpret_cast<TYPE*>(object)->m_mixinConstructorMarker)); \
         return object;                                                  \
     }                                                                   \
     GarbageCollectedMixinConstructorMarker m_mixinConstructorMarker;    \
@@ -205,6 +206,10 @@ public:                                                                 \
     {                                                                   \
         return Heap::isHeapObjectAlive(this);                           \
     }                                                                   \
+    HeapObjectHeader* heapObjectHeader() const override                 \
+    {                                                                   \
+        return HeapObjectHeader::fromPayload(this);                     \
+    }                                                                   \
 private:
 
 #if ENABLE(OILPAN)
@@ -230,7 +235,7 @@ public:
         // happen soon enough and take care of it. Mixin objects aren't
         // overly common.
         ThreadState* state = ThreadState::current();
-        state->leaveGCForbiddenScopeIfNeeded(this);
+        state->finishConstructingGCMixin(this);
     }
 };