[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/Heap.cpp

Index: third_party/WebKit/Source/platform/heap/Heap.cpp
diff --git a/third_party/WebKit/Source/platform/heap/Heap.cpp b/third_party/WebKit/Source/platform/heap/Heap.cpp
index fd2b765e5fb3dccf9ab3f7b998422668810d292d..86544d4ece8d1602f01da1977d0da64742c709f9 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.cpp
+++ b/third_party/WebKit/Source/platform/heap/Heap.cpp
@@ -172,7 +172,7 @@ void Heap::init()
     s_partitionAllocSizeAtLastGC = WTF::Partitions::totalSizeOfCommittedPages();
     s_estimatedMarkingTimePerByte = 0.0;
 #if ENABLE(ASSERT)
-    s_gcGeneration = 1;
+    s_gcGeneration = gcGenerationStart;
 #endif
 
     GCInfoTable::init();
@@ -457,9 +457,9 @@ void Heap::collectGarbage(BlinkGC::StackState stackState, BlinkGC::GCType gcType
     postGC(gcType);
 
 #if ENABLE(ASSERT)
-    // 0 is used to figure non-assigned area, so avoid to use 0 in s_gcGeneration.
+    // 0 and 1 are used to figure specific states in gcGeneration.
     if (++s_gcGeneration == 0) {
-        s_gcGeneration = 1;
+        s_gcGeneration = gcGenerationStart;
     }
 #endif
 
@@ -772,8 +772,6 @@ size_t Heap::s_wrapperCountAtLastGC = 0;
 size_t Heap::s_collectedWrapperCount = 0;
 size_t Heap::s_partitionAllocSizeAtLastGC = 0;
 double Heap::s_estimatedMarkingTimePerByte = 0.0;
-#if ENABLE(ASSERT)
-uint16_t Heap::s_gcGeneration = 0;
-#endif
+uint32_t Heap::s_gcGeneration = gcGenerationUnchecked;
 
 } // namespace blink