[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/HeapPage.h

Index: third_party/WebKit/Source/platform/heap/HeapPage.h
diff --git a/third_party/WebKit/Source/platform/heap/HeapPage.h b/third_party/WebKit/Source/platform/heap/HeapPage.h
index e1f17dea22cd8dd78930fcde1bad120963e296f5..22c220a46034d6728acd545d986f449d697889ae 100644
--- a/third_party/WebKit/Source/platform/heap/HeapPage.h
+++ b/third_party/WebKit/Source/platform/heap/HeapPage.h
@@ -116,12 +116,6 @@ const uint8_t reuseForbiddenZapValue = 0x2c;
 #define CHECK_MEMORY_INACCESSIBLE(address, size) do { } while (false)
 #endif
 
-#if !ENABLE(ASSERT) && CPU(64BIT)
-#define USE_4BYTE_HEADER_PADDING 1
-#else
-#define USE_4BYTE_HEADER_PADDING 0
-#endif
-
 class CallbackStack;
 class FreePagePool;
 class NormalPageHeap;
@@ -130,9 +124,10 @@ class PageMemory;
 class PageMemoryRegion;
 class WebProcessMemoryDump;
 
-// HeapObjectHeader is 4 byte (32 bit) that has the following layout:
+// HeapObjectHeader has two 4 byte (32 bit) members, and one of them has
+// the following bit field layout:
 //
-// | gcInfoIndex (14 bit) | DOM mark bit (1 bit) | size (14 bit) | dead bit (1 bit) | freed bit (1 bit) | mark bit (1 bit) |
+// | gcInfoIndex (14 bit) | DOM mark bit (1 bit) | size (14 bit) | dead bit (1 bit) | freed bit (1 bit) | mark bit (1 bit)
 //
 // - For non-large objects, 14 bit is enough for |size| because the blink
 //   page size is 2^17 byte and each object is guaranteed to be aligned with
@@ -161,6 +156,7 @@ const size_t headerPromptlyFreedBitMask = headerFreedBitMask | headerDeadBitMask
 const size_t largeObjectSizeInHeader = 0;
 const size_t gcInfoIndexForFreeListHeader = 0;
 const size_t nonLargeObjectPageSizeMax = 1 << 17;
+const uint32_t gcGenerationForFreeListEntry = 0;
 
 static_assert(nonLargeObjectPageSizeMax >= blinkPageSize, "max size supported by HeapObjectHeader must at least be blinkPageSize");
 
@@ -168,11 +164,9 @@ class PLATFORM_EXPORT HeapObjectHeader {
 public:
     // If gcInfoIndex is 0, this header is interpreted as a free list header.
     NO_SANITIZE_ADDRESS
-    HeapObjectHeader(size_t size, size_t gcInfoIndex)
+    HeapObjectHeader(size_t size, size_t gcInfoIndex, uint32_t generation)
+        : m_gcGeneration(generation)
     {
-#if ENABLE(ASSERT)
-        m_magic = magic;
-#endif
         // sizeof(HeapObjectHeader) must be equal to or smaller than
         // allocationGranurarity, because HeapObjectHeader is used as a header
         // for an freed entry.  Given that the smallest entry size is
@@ -212,52 +206,30 @@ public:
 
 #if ENABLE(ASSERT)
     bool checkHeader() const;
-    // Zap magic number with a new magic number that means there was once an
-    // object allocated here, but it was freed because nobody marked it during
-    // GC.
-    void zapMagic();
 #endif
+    NO_SANITIZE_ADDRESS
+    uint32_t gcGeneration() const { return m_gcGeneration; }
 
     void finalize(Address, size_t);
     static HeapObjectHeader* fromPayload(const void*);
 
-    static const uint16_t magic = 0xfff1;
-    static const uint16_t zappedMagic = 0x4321;
-
 private:
     uint32_t m_encoded;
-#if ENABLE(ASSERT)
-    uint16_t m_magic;
-#endif
-
-    // In 64 bit architectures, we intentionally add 4 byte padding immediately
-    // after the HeapHeaderObject. This is because:
-    //
-    // | HeapHeaderObject (4 byte) | padding (4 byte) | object payload (8 * n byte) |
-    // ^8 byte aligned                                ^8 byte aligned
-    //
-    // is better than:
-    //
-    // | HeapHeaderObject (4 byte) | object payload (8 * n byte) | padding (4 byte) |
-    // ^4 byte aligned             ^8 byte aligned               ^4 byte aligned
-    //
-    // since the former layout aligns both header and payload to 8 byte.
-#if USE_4BYTE_HEADER_PADDING
-public:
-    uint32_t m_padding;
-#endif
+    // m_gcGeneration keeps track of the number of GC cycles where the object gets
+    // allocated. gcGenerationForFreeListentry indicates that the object has
+    // already been freed.
+    uint32_t m_gcGeneration;
 };
 
 class FreeListEntry final : public HeapObjectHeader {
 public:
     NO_SANITIZE_ADDRESS
     explicit FreeListEntry(size_t size)
-        : HeapObjectHeader(size, gcInfoIndexForFreeListHeader)
+        : HeapObjectHeader(size, gcInfoIndexForFreeListHeader, gcGenerationForFreeListEntry)
         , m_next(nullptr)
     {
 #if ENABLE(ASSERT)
         ASSERT(size >= sizeof(HeapObjectHeader));
-        zapMagic();
 #endif
     }
 
@@ -703,7 +675,7 @@ public:
 #endif
     void takeFreelistSnapshot(const String& dumpBaseName) override;
 
-    Address allocateObject(size_t allocationSize, size_t gcInfoIndex);
+    Address allocateObject(size_t allocationSize, size_t gcInfoIndex, uint32_t generation);
 
     void freePage(NormalPage*);
 
@@ -783,7 +755,8 @@ size_t HeapObjectHeader::size() const
 NO_SANITIZE_ADDRESS inline
 bool HeapObjectHeader::checkHeader() const
 {
-    return !pageFromObject(this)->orphaned() && m_magic == magic;
+    ASSERT(isFree() == (m_gcGeneration == gcGenerationForFreeListEntry));
+    return !pageFromObject(this)->orphaned();
 }
 #endif
 
@@ -855,14 +828,14 @@ void HeapObjectHeader::markDead()
     m_encoded |= headerDeadBitMask;
 }
 
-inline Address NormalPageHeap::allocateObject(size_t allocationSize, size_t gcInfoIndex)
+inline Address NormalPageHeap::allocateObject(size_t allocationSize, size_t gcInfoIndex, uint32_t generation)

[haraken, 2015/11/16 09:38:21]

gcGeneration

[peria, 2015/11/16 12:28:45]

Done.

 {
     if (LIKELY(allocationSize <= m_remainingAllocationSize)) {
         Address headerAddress = m_currentAllocationPoint;
         m_currentAllocationPoint += allocationSize;
         m_remainingAllocationSize -= allocationSize;
         ASSERT(gcInfoIndex > 0);
-        new (NotNull, headerAddress) HeapObjectHeader(allocationSize, gcInfoIndex);
+        new (NotNull, headerAddress) HeapObjectHeader(allocationSize, gcInfoIndex, generation);
         Address result = headerAddress + sizeof(HeapObjectHeader);
         ASSERT(!(reinterpret_cast<uintptr_t>(result) & allocationMask));