[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/Heap.h

Index: third_party/WebKit/Source/platform/heap/Heap.h
diff --git a/third_party/WebKit/Source/platform/heap/Heap.h b/third_party/WebKit/Source/platform/heap/Heap.h
index 67a8bc873ef643166d19459cecc0c07fab89dab3..42fd1af3b18eb5e2c3c1a5de36c1f672c85197eb 100644
--- a/third_party/WebKit/Source/platform/heap/Heap.h
+++ b/third_party/WebKit/Source/platform/heap/Heap.h
@@ -96,17 +96,17 @@ public:
     template<typename T>
     static inline bool isHeapObjectAlive(const Member<T>& member)
     {
-        return isHeapObjectAlive(member.get());
+        return isHeapObjectAlive(member.unsafeGet());
     }
     template<typename T>
     static inline bool isHeapObjectAlive(const WeakMember<T>& member)
     {
-        return isHeapObjectAlive(member.get());
+        return isHeapObjectAlive(member.unsafeGet());
     }
     template<typename T>
     static inline bool isHeapObjectAlive(const UntracedMember<T>& member)
     {
-        return isHeapObjectAlive(member.get());
+        return isHeapObjectAlive(member.unsafeGet());
     }
     template<typename T>
     static inline bool isHeapObjectAlive(const RawPtr<T>& ptr)
@@ -259,9 +259,12 @@ public:
     static void reportMemoryUsageHistogram();
     static void reportMemoryUsageForTracing();
 
-#if ENABLE(ASSERT)
-    static uint16_t gcGeneration() { return s_gcGeneration; }
-#endif
+    static uint32_t gcGeneration()
+    {
+        ASSERT(s_gcGeneration != gcGenerationUnchecked);
+        ASSERT(s_gcGeneration != gcGenerationForFreeListEntry);
+        return s_gcGeneration;
+    }
 
 private:
     // A RegionTree is a simple binary search tree of PageMemoryRegions sorted
@@ -308,9 +311,7 @@ private:
     static size_t s_collectedWrapperCount;
     static size_t s_partitionAllocSizeAtLastGC;
     static double s_estimatedMarkingTimePerByte;
-#if ENABLE(ASSERT)
-    static uint16_t s_gcGeneration;
-#endif
+    static uint32_t s_gcGeneration;
 
     friend class ThreadState;
 };
@@ -455,7 +456,7 @@ inline Address Heap::allocateOnHeapIndex(ThreadState* state, size_t size, int he
     ASSERT(state->isAllocationAllowed());
     ASSERT(heapIndex != BlinkGC::LargeObjectHeapIndex);
     NormalPageHeap* heap = static_cast<NormalPageHeap*>(state->heap(heapIndex));
-    return heap->allocateObject(allocationSizeFromSize(size), gcInfoIndex);
+    return heap->allocateObject(allocationSizeFromSize(size), gcInfoIndex, gcGeneration());
 }
 
 template<typename T>