[Oilpan] Add use-after-free detector in Member<>

third_party/WebKit/Source/platform/heap/ThreadState.h

Index: third_party/WebKit/Source/platform/heap/ThreadState.h
diff --git a/third_party/WebKit/Source/platform/heap/ThreadState.h b/third_party/WebKit/Source/platform/heap/ThreadState.h
index 576519cdc0cff84f90f21f525cd9f90204948694..26c8d3ba7b0bd5def0ca9f300e7b21be809a0ec2 100644
--- a/third_party/WebKit/Source/platform/heap/ThreadState.h
+++ b/third_party/WebKit/Source/platform/heap/ThreadState.h
@@ -292,7 +292,14 @@ public:
     bool isAllocationAllowed() const { return !isAtSafePoint() && !m_noAllocationCount; }
     void enterNoAllocationScope() { m_noAllocationCount++; }
     void leaveNoAllocationScope() { m_noAllocationCount--; }
-    bool isGCForbidden() const { return m_gcForbiddenCount; }
+
+    // By entering a gc-forbidden scope, conservative GCs will not
+    // be allowed while handling an out-of-line allocation request.
+    // Intended used when constructing subclasses of GC mixins, where
+    // the object being constructed cannot be safely traced & marked
+    // fully should a GC be allowed while its subclasses are being
+    // constructed.
+    bool isGCForbidden() const { return m_gcForbiddenCount || isConstructingGCMixin(); }
     void enterGCForbiddenScope() { m_gcForbiddenCount++; }
     void leaveGCForbiddenScope()
     {
@@ -301,6 +308,22 @@ public:
     }
     bool sweepForbidden() const { return m_sweepForbidden; }
 
+    bool isConstructingGCMixin() const { return m_gcMixinMarker; }
+    void startConstructingGCMixin(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
+    {
+        ASSERT(checkThread());
+        if (!m_gcMixinMarker) {
+            m_gcMixinMarker = gcMixinMarker;
+        }
+    }
+    void finishConstructingGCMixin(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
+    {
+        ASSERT(checkThread());
+        if (m_gcMixinMarker == gcMixinMarker) {
+            m_gcMixinMarker = nullptr;
+        }
+    }
+
     void flushHeapDoesNotContainCacheIfNeeded();
 
     // Safepoint related functionality.
@@ -430,29 +453,6 @@ public:
         m_traceDOMWrappers = traceDOMWrappers;
     }
 
-    // By entering a gc-forbidden scope, conservative GCs will not
-    // be allowed while handling an out-of-line allocation request.
-    // Intended used when constructing subclasses of GC mixins, where
-    // the object being constructed cannot be safely traced & marked
-    // fully should a GC be allowed while its subclasses are being
-    // constructed.
-    void enterGCForbiddenScopeIfNeeded(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
-    {
-        ASSERT(checkThread());
-        if (!m_gcMixinMarker) {
-            enterGCForbiddenScope();
-            m_gcMixinMarker = gcMixinMarker;
-        }
-    }
-    void leaveGCForbiddenScopeIfNeeded(GarbageCollectedMixinConstructorMarker* gcMixinMarker)
-    {
-        ASSERT(checkThread());
-        if (m_gcMixinMarker == gcMixinMarker) {
-            leaveGCForbiddenScope();
-            m_gcMixinMarker = nullptr;
-        }
-    }
-
     // vectorBackingHeap() returns a heap that the vector allocation should use.
     // We have four vector heaps and want to choose the best heap here.
     //